Security

Report a vulnerability

SECURITY.md

Security Policy

WinterSolve is intended to work with developer projects, which may include sensitive source code, secrets, logs, and configuration files.

Security Goals

Avoid exposing private code unnecessarily.
Make AI provider behavior explicit.
Support safer local workflows over time.
Encourage careful handling of logs, secrets, and credentials.

Reporting a Vulnerability

If you find a security issue, please report it privately to the maintainers instead of opening a public issue.

Include:

A clear description of the issue
Steps to reproduce
Potential impact
Suggested fix, if known

Sensitive Data Guidelines

WinterSolve contributors should avoid committing:

API keys
Access tokens
Passwords
Private logs
Customer data
Proprietary code samples without permission

There aren't any published security advisories