This policy extends Knitli's organizational security policy; please see that reference for detailed instructions on reporting, vulnerability disclosures, and other security information.

Do not include real, controlled, or classified information in any report, ever. If you believe a real problem can only be shown with real data, tell us "I think you need to see real data to understand the problem." We will figure out a way ahead from there.

Each release lists SHA-256 checksums for the schema files and package, and carries a GitHub build-provenance attestation. To check a downloaded file:

gh attestation verify <file> --repo knitli/OpenSCG

The npm package is published with npm provenance. To check it:

npm audit signatures