Security policy

This policy covers every repository in the sandtable-ai organization.

Reporting a vulnerability

Please don't open a public issue. Report it privately on GitHub instead: report a vulnerability. You should hear back within a week.

Use fictional data in the report, and never include a real API key.

What to report

• Anything in the sandtable security policy, which covers the CLI, the library, the Python launcher and the Claude Code plugin.
• A secret, credential or real personal data in a published transcript or report in sandtable-ai/leaderboard. Every domain there is fictional, so anything real is a bug.