If you discover a security vulnerability in ClawBird, please report it responsibly:

1. DO NOT create a public GitHub issue
2. Email: security@clawbird.dev (or create a placeholder email)
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We will:

• Acknowledge receipt within 48 hours
• Provide a timeline for a fix
• Credit you in the security advisory (if desired)

When using ClawBird:

• Never commit credentials or sensitive data
• Use environment variables for configuration
• Run browser in isolated profile
• Be cautious with --disable-web-security flag
• Review workflows before execution