Trust
Security
Security Policy
Supported Versions
| Package | Version | Supported |
|---|---|---|
@aegis-skills/core (current npm release) |
1.0.x | :white_check_mark: |
@aegis-skills/core |
< 1.0 | :x: |
aegis-skills, @aegis-skills/themis* (restructured packages) |
unreleased | fixes land on main |
Reporting a Vulnerability
We take the security of Aegis and Themis seriously. If you discover a security vulnerability or flaw in any of our skills, rules, or core modules, please disclose it responsibly.
How to Report
- GitHub private vulnerability reporting (the only channel): https://github.com/drupadsachania/aegis-skills/security/advisories/new
- Do NOT open public GitHub issues for security vulnerabilities, and do not send vulnerability reports by email.
Other contact
For general questions write to support@kairos-foundation.org; for privacy questions write to privacy@kairos-foundation.org. These addresses are not a vulnerability reporting channel.
Response Timeline
- Acknowledgement: Within 48 hours.
- Assessment & Fix: Targeted within 7 business days for critical flaws affecting execution boundaries or guardrails.
How this site is built
- No model calls, no accounts, no cookies, no analytics, no database.
- Every API is read-only and serves public skill content only.
- Strict security headers on every response: HSTS, a same-origin Content-Security-Policy, X-Frame-Options DENY, nosniff and a locked-down Permissions-Policy.
- Docs are rendered from repository markdown with all raw HTML escaped.
What runs where, what each path contacts and how to verify it yourself: Trust and data flow. Terms of use and privacy: terms of service and privacy policy.
Compliance mapping
The Themis controls mapped to the OWASP Top 10 for LLM Applications, NIST CSF, ISO 27001, SOC 2 and CIS Controls. It is an informational mapping, not a certification: read the mapping.