We release updates to skills on a quarterly basis. Security issues are addressed as soon as possible.

If you discover a security vulnerability in any skill, please report it by:

1. DO NOT open a public issue
2. Email the maintainers (or use GitHub Security Advisories)
3. Include:
   • Affected skill(s)
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if available)

• Response Time: Within 48 hours
• Updates: Every 5-7 days during investigation
• Resolution: Security patches released ASAP
• Credit: Public acknowledgment in release notes (if desired)

• ✅ Use skills from official marketplace only
• ✅ Keep skills updated (check quarterly)
• ✅ Review skill code before using in production
• ✅ Report suspicious patterns or vulnerabilities

• ✅ Never include credentials, tokens, or API keys
• ✅ Validate all user inputs in examples
• ✅ Follow SAP security best practices
• ✅ Use latest stable package versions
• ✅ Document known security considerations

This repository is covered by two free GitHub features for public repos (no paid Advanced Security license required):

• Workflow: .github/workflows/codeql.yml · Config: .github/codeql/codeql-config.yml
• Languages analyzed: JavaScript/TypeScript, Python, and Java.
• Runs on every push/PR to main that touches source code (content-only changes are ignored), plus a weekly scheduled scan to catch newly-released queries.
• Results appear in the repository's Security → Code scanning alerts tab.
• Note: Java analysis runs without a build (build-mode: none) because the repo has no Maven/Gradle build, so results are best-effort for the Eclipse plugin source.

• Config: .github/dependabot.yml
• Surfaces vulnerability advisories and opens PRs for outdated dependencies (npm) and pinned GitHub Actions, grouped weekly to reduce review load.

Findings from either tool are triaged like any other reported vulnerability (see Reporting a Vulnerability above).

Skills provide guidance on SAP APIs and services. Always:

• Use environment variables for secrets
• Never hardcode credentials
• Follow SAP's security recommendations
• Implement proper authentication/authorization

Skills reference npm packages and SDKs. Always:

• Verify package authenticity
• Check for known vulnerabilities
• Use lock files for reproducible builds
• Keep dependencies updated

This security policy covers:

• ✅ Skills content and recommendations
• ✅ Documentation and examples
• ✅ Repository infrastructure

This policy does NOT cover:

• ❌ SAP products themselves (report to SAP)
• ❌ Third-party packages (report to package maintainers)
• ❌ Claude Code/Desktop platforms (report to Anthropic/Factory)

• SAP Trust Center
• SAP Security Patch Day
• OWASP Top 10

Thank you for helping keep SAP Skills secure! 🔒