# Security Policy


# Reporting a vulnerability

Report it privately: this repository's **Security** tab, **Report a vulnerability**. Only the maintainers can read the report. Please do not open a public issue, pull request or discussion about it.

Fixes land on `main` and in the next release; only the latest release is supported.


# Scope

In scope: anything in this repository that decides what tether reads, writes or deletes in your stores and repositories, or what it does with the credentials it is given (the Neon API key, cloud credentials, the untracked `.tether/secrets.toml`) - the library and CLI under `src/tether/` - and the workflow that builds and publishes the package to PyPI.

Out of scope: vulnerabilities in the services and formats tether drives (Neon, S3 and other object stores, Iceberg catalogs, Lance, Icechunk, Delta, Zarr, git and jj; report those upstream) and in its dependencies.

tether acts with whatever credentials its environment holds: it can delete what they can delete. Give a CI job or a preview the narrowest role that does its job.