Security Policy

Report security issues privately through GitHub Security Advisories for the MendCode/mendcode-packages repository.

Do not open public issues for leaked credentials, bypasses in package validation, malicious package behavior, or registry integrity problems.

Package Security Rules

No .env*, auth files, tokens, private keys, certificates, local database files, run logs, generated output, cache folders, dependency folders, or binary/archive payloads.
No install scripts that mutate user machines.
No package may create worktrees, install TSM, start services, delete branches, or alter auth/session state at install time.
All package artifacts must be declared in mend-package.json and indexed in .mendcode/marketplace/index.json.
Catalog digests must match the package content.