Stream Coding is a methodology framework (documentation + scripts), not a running service. However, if you discover a security issue in any of the bundled scripts (e.g., verify.py, install.sh), please report it responsibly.

1. Do NOT open a public issue for security vulnerabilities
2. Email jeremy.garreau@pyl.tech with:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

The following are in scope:

• Scripts in .agents/skills/*/scripts/
• The install.sh installer
• Any file that executes code or modifies the user's system

The following are out of scope:

• Documentation content (Markdown files)
• Templates and examples
• Methodology rules (non-executable)

This project includes a /security-review skill that covers:

• OWASP Top 10 checks
• Secrets detection
• Dependency auditing
• Pre-commit security checklists

We encourage contributors to run /security-review on any code changes.