Skip to content

SECURITY.md

Latest commit

 

History

History
38 lines (24 loc) · 959 Bytes

SECURITY.md

File metadata and controls

38 lines (24 loc) · 959 Bytes
Raw

Security Policy

Task Cost Estimator is a local CLI. It may read API keys from environment variables or from ~/.tce/config.json, but those values must never be committed to the repository.

Supported Versions

Security fixes are considered for the latest public release and the current main branch.

Version Supported
v0.1.x Yes

Reporting a Vulnerability

Please do not open a public GitHub issue for vulnerabilities involving credential exposure or unsafe request handling.

Contact the maintainer through GitHub:

Include:

  • A short description.
  • Reproduction steps.
  • Affected version or commit.
  • Potential impact.

In Scope

  • API key leakage.
  • Unsafe config handling.
  • Unexpected network destinations.
  • Dependency or request-signing issues.

Out of Scope

  • Incorrect cost estimates without a security impact.
  • Pricing drift caused by provider pricing changes.