SECURITY.md

Security Policy

🛡️ Supported Versions

Version	Supported
Main	:white_check_mark:

---

🚨 Reporting a Vulnerability

If you discover a potential security vulnerability in OpenCode CLI, please report it responsibly:

1. Do NOT open a public GitHub issue.
2. Send an email to the repository owner or submit a private security disclosure on GitHub.
3. Include:
   • Type of issue (e.g., buffer overflow, unauthenticated access, command injection)
   • Full steps or proof-of-concept to reproduce
   • Potential impact of the vulnerability

We will respond to security reports within 48 hours and provide periodic updates until the issue is resolved.

---

🔒 Security Best Practices for Deployment

• Reverse Proxy & API Authentication: Keep master API key authorization and strong admin credentials configured in production deployments.