skill2workflow is at Self-hosted Beta maturity. Security fixes target the latest released 0.1.x version and the current main branch. Older snapshots, forks, modified connector packages, and deployments outside the documented single-tenant boundary may require their maintainers to port a fix.

Do not open a public issue, discussion, or pull request for a suspected security vulnerability. Use GitHub's private vulnerability report.

If that form is unavailable, open only a detail-free support request asking a maintainer to establish a private channel. Do not include exploit steps, credentials, customer data, private workflow state, tokens, provider payloads, or screenshots containing sensitive values in that request.

A useful private report includes:

• the affected release or commit;
• the security boundary and realistic impact;
• minimal, sanitized reproduction steps;
• whether the issue affects default configuration;
• any safe mitigation already tested.

Maintainers aim to acknowledge a complete private report within seven calendar days and provide an initial triage update within fourteen calendar days. These security response targets are coordination goals, not service-level guarantees. Remediation and disclosure timing depend on severity, reproducible evidence, release safety, and reporter coordination.

The supported service is loopback-only, self-hosted, single-tenant, and expects external TLS termination plus operator-managed filesystem permissions. High value reports include authentication bypass, credential disclosure, unsafe path or symlink handling, state-integrity failure, cross-workflow data leakage, or automatic replay after an unknown external side effect.

The installed/source ui command serves only its fixed public asset inventory, not the surrounding directory. GET and HEAD reject unknown paths and symlinked assets without exposing file names or contents. See the UI static boundary for its descriptor, size and platform limits; generic development file servers do not provide that product boundary.

Executing an intentionally trusted workflow's configured outbound HTTP request is expected behavior. Hosted multi-tenancy, built-in TLS, OAuth, a managed secret store, distributed workers, and exactly-once execution are not current security claims. Read the service security boundary, credential boundary, and interrupted-run recovery contract before evaluating those boundaries.

Do not test against a real partner tenant, customer workload, or third-party account without explicit authorization. Use local fixtures and synthetic data.

Please allow maintainers time to reproduce, fix, test, and release before public disclosure. The project will credit reporters when requested and safe to do so. Do not include secrets or private customer evidence in advisories, commits, release notes, or regression fixtures.