Security claims should name their boundary.

RuleOak separates secure-development practices, application-layer controls, hosted-repository settings and external assurance so one does not masquerade as another.

Open-source security posture

• Public vulnerability reporting policy and private disclosure route.
• Immutable-pinned GitHub Actions in the release source.
• Dependency review, CodeQL workflow preparation and automated source/security checks.
• REUSE/SPDX licensing hygiene and release SBOM/provenance preparation.
• Explicit application-layer non-goals and threat-model assumptions.

Application-layer boundary

The RuleOak open-source runtime can govern supported actions that actually cross its SDK/CLI/MCP boundary. It is not an OS sandbox, EDR, anti-malware system, universal prompt-injection detector or universal DLP product.

Hosted controls require hosted evidence

Branch protection, secret scanning, MFA, private vulnerability reporting and published artifact attestations are repository/deployment properties. Source configuration can prepare them but cannot prove they are enabled on the live repository.

Report vulnerabilities privately

Do not publish an unpatched vulnerability in a public issue. Use the process on Responsible Disclosure and the repository's SECURITY.md.