We release updates to skills on a quarterly basis. Security issues are addressed as soon as possible.

If you discover a security vulnerability in any skill, please report it by:

1. DO NOT open a public issue
2. Email the maintainers (or use GitHub Security Advisories)
3. Include:
   • Affected skill(s)
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if available)

• Response Time: Within 48 hours
• Updates: Every 5-7 days during investigation
• Resolution: Security patches released ASAP
• Credit: Public acknowledgment in release notes (if desired)

• ✅ Use skills from official marketplace only
• ✅ Keep skills updated (check quarterly)
• ✅ Review skill code before using in production
• ✅ Report suspicious patterns or vulnerabilities

• ✅ Never include credentials, tokens, or API keys
• ✅ Validate all user inputs in examples
• ✅ Follow SAP security best practices
• ✅ Use latest stable package versions
• ✅ Document known security considerations

This repository is covered by two free GitHub features for public repos (no paid Advanced Security license required):

• Workflow: .github/workflows/codeql.yml · Config: .github/codeql/codeql-config.yml
• Languages analyzed: JavaScript/TypeScript, Python, and Java.
• Runs on every push/PR to main that touches source code (content-only changes are ignored), plus a weekly scheduled scan to catch newly-released queries.
• Results appear in the repository's Security → Code scanning alerts tab.
• Note: Java analysis runs without a build (build-mode: none) because the repo has no Maven/Gradle build, so results are best-effort for the Eclipse plugin source.

• Config: .github/dependabot.yml
• Surfaces vulnerability advisories and opens PRs for outdated dependencies (npm) and pinned GitHub Actions, grouped weekly to reduce review load.

• Script: npm run lint:workflows, run inside quality-checks.yml on every push/PR to main. The binaries are downloaded from their official releases at pinned versions (actionlint v1.7.12, zizmor v1.29.0) and verified against embedded SHA-256 digests before use.
• actionlint checks workflow syntax, correctness, and embedded shell scripts. zizmor checks Actions security rules: unpinned action references, over-broad token scopes, template injection, and cache poisoning.
• Pinning policy: every uses: reference is pinned to a full commit SHA (owner/action@<40-char-sha> # vX.Y.Z), Dependabot keeps the SHAs current, and all checkouts run with persist-credentials: false.
• Hardening policy: every workflow declares least-privilege permissions:, a timeout-minutes on every job, and a concurrency group; no ${{ }} template expressions appear inside run: shell bodies (values arrive through step env:).
• Any finding fails the build. Suppression annotations are not used. Background and incident research: docs/project/github-actions-security-hardening-2026-08-29.md.

Findings from any of these tools are triaged like any other reported vulnerability (see Reporting a Vulnerability above).

Skills provide guidance on SAP APIs and services. Always:

• Use environment variables for secrets
• Never hardcode credentials
• Follow SAP's security recommendations
• Implement proper authentication/authorization

Skills reference npm packages and SDKs. Always:

• Verify package authenticity
• Check for known vulnerabilities
• Use lock files for reproducible builds
• Keep dependencies updated

This security policy covers:

• ✅ Skills content and recommendations
• ✅ Documentation and examples
• ✅ Repository infrastructure

This policy does NOT cover:

• ❌ SAP products themselves (report to SAP)
• ❌ Third-party packages (report to package maintainers)
• ❌ Claude Code/Desktop platforms (report to Anthropic/Factory)

• SAP Trust Center
• SAP Security Patch Day
• OWASP Top 10

Thank you for helping keep SAP Skills secure! 🔒