Please report security vulnerabilities privately. Do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting on this repository:

1. Go to the Security tab of firelock-ai/kin-lsp.
2. Click Report a vulnerability to open a private security advisory.
3. Include a description, affected versions, reproduction steps, and the impact you observed.

We aim to acknowledge new reports within a few business days and will keep you informed as we investigate. Please give us a reasonable opportunity to release a fix before any public disclosure.

There is no paid bug-bounty program at this time.

Kin is pre-1.0 and published as 0.x releases (alpha-grade: APIs and formats may change between minor versions). Only the most recent 0.x release receives security fixes; older tags are not patched. Fixes are shipped in a new 0.x release rather than backported.

When a 1.0 line is published, this table will be updated with a concrete support window.

This policy covers the kin-lsp repository: the language-server enrichment boundary, which adds type-resolved graph relations (call hierarchy, type hierarchy, and type-definition links) from standard language servers. Other Kin ecosystem repositories (for example kin, kin-db, kin-vfs, kinlab) carry their own security policies; report issues against the repository where the affected code lives.