If you discover a security vulnerability in zeroshot, please report it responsibly:

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Email the maintainers directly at: security@covibes.io
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Any suggested fixes (optional)

• Initial response: Within 48 hours
• Status update: Within 7 days
• Fix timeline: Depends on severity, typically within 30 days for critical issues

This policy applies to:

• The zeroshot CLI tool
• Agent execution and isolation mechanisms
• Message bus and ledger components
• Docker container configurations

• Issues in Claude Code CLI itself (report to Anthropic)
• Issues in dependencies (report to respective maintainers)
• Social engineering attacks

Thank you for helping keep zeroshot secure!