If you discover a security vulnerability in Bashkit, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please email security issues to: security@everruns.com

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 7 days
• Resolution target: Within 30 days for critical issues

This security policy applies to:

• The bashkit crate
• The bashkit-cli crate
• Official examples and documentation

Bashkit is designed as a sandboxed interpreter. Key security boundaries:

See specs/009-implementation-status.md for documented gaps and limitations.

We appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities (with permission).