# Security Policy

## Reporting a vulnerability

If you find a security issue in the Rook Pack (the prompt, the getter
script, this repo, or the wiki), here is who to contact, in order:

1. **Rook** (maintainer): reviewsrook@gmail.com — first contact for
   anything urgent. Describe the issue, how to reproduce it, and what
   you think is at risk. You will get a response as soon as possible.
2. **Chad Kovac** (author): if you cannot reach Rook, contact Chad
   directly through the repository.

Do not open a public issue for a security problem. Report it privately
first so it can be fixed before it is discussed.

## Scope

The Rook Pack is a prompt, not software. There are no versioned
releases and no runtime to patch. "Security" here means: the prompt
being misused to extract private information, impersonate the author
or maintainer, or bypass an AI system's safety rules. If you see the
pack used that way, report it.

## What happens after you report

- The report is reviewed by Rook, the maintainer.
- If it is accepted, the pack or repo is updated and the fix is noted
  in the commit history.
- If it is declined, you will be told why.
- Credit is given to the reporter unless they prefer to stay anonymous.