If you believe you have found a security vulnerability in the CLF specification or related repository materials, report it through GitHub private vulnerability reporting / GitHub Security Advisories for this repository.

• Do not open a public issue for an unpatched vulnerability.
• Include the affected version, impacted surface, reproduction details, and expected risk.
• If the vulnerability is in a third-party CLF implementation, report it to that implementation's maintainers unless the issue appears to stem from the CLF specification itself.

• Reports will be acknowledged within 5 business days of receipt.
• An initial severity and scope assessment will follow within 10 business days.
• Fix timelines depend on severity and exploitability and will be communicated to the reporter after triage.
• Coordinated disclosure is preferred until mitigations are available.
• If you do not receive an acknowledgment within 5 business days, please follow up by opening a GitHub Security Advisory directly so the report is not lost.

Security-sensitive areas in this repository and specification include:

• Trust boundaries between the orchestrator, adapters, subordinates, and external sources (Section 6.3 of the specification)
• Prompt injection and indirect prompt injection handling, including instruction priority enforcement in injectPrompt() and adapter hooks
• Secret handling via secretRef, which must resolve through the host secret manager and must not be serialized into configuration exports, checkpoints, event payloads, or audit logs
• Adapter authorization and session or tenant scoping, including SecurityContext enforcement and multi-tenant partitioning by tenantId + sessionId
• Event publication and auditability of sensitive actions, including configuration changes, pattern imports and promotions, deletion actions, and external invalidation events
• Webhook-based invalidation sources, which must validate request authenticity before generating framework events

This repository contains a specification, not a single production implementation. Some vulnerabilities may arise from how a host runtime interprets or implements the spec rather than from the spec text itself. Reporters are encouraged to note whether the issue appears to be a spec ambiguity or an implementation gap, as this affects remediation path and disclosure coordination.