# Security policy

Report suspected vulnerabilities privately to `security@sandwichhime.com`.
Please include the affected Tend version, configuration shape, reproduction,
and expected impact. Do not include production credentials or private logs.

Tend treats reviewed source, pinned toolchains, root-owned server policy and
configuration, handwritten Caddy templates, and operators as trusted. It treats
requested service names, protocol frames, artifact paths and bytes, archives,
filesystem state, process output, HTTP responses, and deployment targets as
adversarial inputs. It never evaluates configuration as shell code.

The preview is not a sandbox and does not make an untrusted repository safe to
build. Run `tend package` only for reviewed source. Production configuration,
receive policy, host keys, identities, and `0600` environment files stay outside
repositories. A secret value appearing in a Tend report, artifact, state file,
or process argument is a security defect and should be reported.