If you discover a security vulnerability in any VERGIL component, please report it through GitHub's private vulnerability reporting. This ensures your report is handled confidentially.
If private vulnerability reporting is unavailable, email w.phillip.moore@gmail.com with the subject line "VERGIL Security Report". Do not open a public issue for security vulnerabilities.
The following components are in scope for security reports:
- vergil-tooling — Python CLI tools (
vrg-commit,vrg-validate,vrg-submit-pr,vrg-prepare-release,vrg-docker-run, and others), git hooks, and shared libraries - vergil-docker — Dev container images, Dockerfiles, and build scripts
- vergil-actions — Reusable GitHub Actions workflows and composite actions
- vergil-claude-plugin — Claude Code plugin hooks, skills, and configuration
- Vulnerabilities in upstream dependencies (report these to the upstream maintainer)
- Vulnerabilities in GitHub, Docker, or other third-party platforms
- Social engineering attacks against project contributors
- Acknowledgment: within 7 days of receiving a report
- Assessment: initial severity assessment within 14 days
- Resolution: target fix or mitigation plan within 30 days of acknowledgment, depending on severity and complexity
These timelines reflect the project's current scale as a small community project. Response times may vary, but every report will be acknowledged and investigated.
We follow coordinated disclosure. Once a fix is available, we will:
- Release the fix across affected components
- Publish a security advisory on GitHub
- Credit the reporter (unless they request anonymity)
We ask that reporters allow reasonable time for a fix before public disclosure.