sandwich-hime-tooling/SECURITY.md

Security policy

Report suspected vulnerabilities privately to security@sandwichhime.com. Include the affected version, platform, reproduction steps, and expected impact without secrets or unnecessary personal data. Expect a best-effort acknowledgement within three business days, initial triage within seven, and an update at least every fourteen days while work remains open.

The preview has no bug bounty. Good-faith research that avoids privacy harm, service disruption, credential access, persistence, and public disclosure before a reasonable remediation period is welcome.

The Agent Skill is instruction text. The VS Code extension starts a locally installed Hime-san only inside a trusted workspace and never downloads or upgrades it. Syntax highlighting remains available in untrusted workspaces; all subprocess-backed features are disabled.