# Security Policy

This project is now marketed as HanaAgent. During the rename transition, the repository and security-reporting URLs intentionally remain on the legacy `openhanako` GitHub path.

## Reporting a Vulnerability

If you discover a security vulnerability, please report it through GitHub:

- Open a private vulnerability report in the repository Security tab when available:
  https://github.com/liliMozi/openhanako/security
- If private reporting is not available, open an issue:
  https://github.com/liliMozi/openhanako/issues

Please include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact

I will respond within 72 hours and work with you on a fix before public disclosure.

## Scope

- Sandbox escape (PathGuard / Seatbelt bypass)
- Credential leakage
- Remote code execution
- Cross-site scripting in the Electron renderer
