Only the latest main branch of this repository is supported for security updates.
| Version | Supported |
|---|---|
| 1.0.x | ✅ |
| < 1.0 | ❌ |
We take the security of our EngOps skills seriously. If you find a vulnerability (e.g., a way to bypass the PII Guard or a credential leak pattern), please do not open a public issue.
Instead, please send an email to security@khairul.io (or your designated security contact).
You can expect a response within 48 hours. We use coordinated disclosure and will credit researchers for their findings.
- Dependency Auditing: We scan our integration examples and scripts for insecure dependencies.
- Auth Hardening: We only recommend token-based or OAuth2-based authentication.
- Data Isolation: None of the skills in this repo "call home" or transmit data to third-party endpoints other than the APIs you configure (Jira, GitHub, Outline).
- PII-First Design: Security is not an afterthought; it is a "Horizontal Core" of the project.
Securing the workspace, one skill at a time.