From e231b42a9a5c73703c43bc7e0ff1f7e946a340ea Mon Sep 17 00:00:00 2001
From: Ty <tybala@outlook.com>
Date: Mon, 27 Jul 2026 16:06:27 +0000
Subject: [PATCH] docs: add SECURITY policy

---
 SECURITY.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..2490bb3
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Product invariants
+
+- Agent never executes payments, refunds, or bill-pay.
+- Client outbound messages and social posts are draft-only unless a future gated send is explicitly designed.
+- Secrets never commit to git (use OpenShell providers / host env).
+- Owner never receives host shell, Docker, or editor instructions from the assistant.
+
+## Reporting
+
+Report security issues privately to the repository maintainers (Ty_Tech org admins). Do not open public issues with secrets, tokens, or production PII.
+
+## Dependencies
+
+- Prefer pinned versions of NemoClaw, OpenShell, Hermes, and MCP packages.
+- Automatic product updates are on by default; review release notes for major pins.
+
+## Logging
+
+Default log level is production (redacted). Do not enable trace in owner-facing demos.