This policy covers this repository: the Formation platform under platform/ (its API, authentication, sessions, and persistence), the launch engine's TypeScript validators and tooling under skill/b2c-mobile-business-launch/, the templates and references the engine ships, the GitHub Actions workflows, and the npm dependency chain behind them.

It does not cover apps launched with the engine. Those get their own security plan from business/trust/SECURITY.md, which is a different document for a different audience: the threat model, hardening, and release gates of a shipped consumer app.

Use GitHub's private vulnerability reporting form. Do not open a public issue for a security problem.

Include, as far as you have it:

• What an attacker gains, and what access they need to start.
• The file or command involved, and a reproduction.
• Which version you tested against (skill/b2c-mobile-business-launch/skill-version.json).

Expect an acknowledgement within a few days. This is a small project, so please allow reasonable time for a fix before public disclosure.

Fixes land on main and go out in the next version bump. Older releases are not backported. Check the installed runtime against source before assuming you're current:

npm run check:skill-version -- \
  --source skill/b2c-mobile-business-launch \
  --installed ~/.codex/skills/b2c-mobile-business-launch

• An authentication, session, workspace-membership, or same-origin bypass in the Formation platform under platform/server/, or a platform route that leaks another workspace's data.
• A validator that passes copy, state, or configuration it exists to reject, where the miss lets a real secret, credential, or unsafe release through.
• Secret values, tokens, or credentials committed anywhere in this repo, including fixtures and generated reports.
• A template or starter scaffold that ships an insecure default into every business created from it. The archetype starters carry RLS policies and pgTAP tests precisely because this class of bug propagates.
• Code execution or path traversal reachable through a validator's flags or input files.
• A workflow that leaks secrets, runs untrusted input with write permissions, or lets a fork PR reach privileged scopes.
• A compromised or malicious dependency in either package.json.

• Security issues in an app you launched with the engine. Those belong to that app.
• Vulnerabilities in third-party services the playbooks reference (RevenueCat, Doppler, PostHog, Stripe, Resend, Apple, Google). Report those to the vendor.
• Findings that require an attacker to already control your machine, your agent runtime, or your shell.
• Missing hardening with no demonstrated impact.

• GitHub Actions are pinned to full commit SHAs with version comments.
• Workflows default to contents: read, and only the weekly source-refresh job re-grants write scopes.
• check:secrets and check:template-safety fail the build on raw secret patterns and real-looking values in state, templates, and cockpits.
• .env.example files are names-only by contract, enforced for the shipped archetype starters by check:archetype-starter.
• The live behavioral eval workflow is manual-dispatch only, so an API key never runs on an untrusted PR.