This document outlines the security audits, data privacy principles, and vulnerability reporting procedures for the Saudi National Design System (NDS) AI Skill repository.

This repository and its AI Skill directory (skill/) have been compiled using strict security audits to ensure safe deployment across local and cloud environments:

1. Asset Sanitization:
   • Heavy framework JS/CSS bundles (originally exceeding 1.4GB) have been completely stripped. This guarantees no untrusted or outdated JS code is processed by your local AI environment, removing execution-based vulnerabilities.
2. SVG Image Security:
   • All vector diagrams (.svg files) in this repository have been audited to ensure they contain only passive vector paths. No embedded scripts (XSS payloads) or external resource requests (SSRF risks) are present.
3. 100% Offline & Privacy-Focused:
   • The compiled AI Skill runs entirely offline. There are no tracking scripts, analytical trackers, or outbound network calls. This preserves the absolute privacy of your codebases and proprietary design metadata during development.

If you discover any security issues or vulnerabilities:

1. Do Not Open Public Issues: Please avoid opening public Issues on GitHub for active vulnerabilities to protect other users.
2. Private Disclosure: Submit a private draft via GitHub Security Advisories on this repository, or contact Mohammed Aboalrejal directly. We will review it promptly and release a patched version.