SECURITY.md

Security Policy

🔒 Reporting Security Vulnerabilities

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please report it privately:

Email: [[email protected]]

You should receive a response within 48 hours. If not, please follow up to ensure we received your report.

---

📋 What to Include in Your Report

Please provide:

1. Description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact of the vulnerability
4. Affected versions (if applicable)
5. Suggested fix (if you have one)
6. Any supporting materials (proof-of-concept, screenshots, etc.)

---

🛡️ Our Security Process

1. Acknowledgment

We'll acknowledge your report within 48 hours.

2. Investigation

We'll investigate and validate the issue within 7 days.

3. Fix Development

We'll develop and test a fix.

4. Disclosure

We'll coordinate disclosure timing with you.

5. Release

We'll release the security update.

6. Credit

We'll acknowledge your contribution (unless you prefer anonymity).

---

✅ Security Best Practices

When contributing to this repository:

• ❌ Never commit credentials, API keys, or secrets
• ✅ Use environment variables for sensitive configuration
• ✅ Keep dependencies up to date
• ✅ Run security tests before submitting pull requests
• ✅ Review the .gitignore to ensure sensitive files are excluded

---

🤖 Automated Security

This repository uses:

• Dependabot - Automated dependency vulnerability alerts and updates
• GitHub Code Scanning - Automated security analysis
• Secret Scanning - Prevents credential leaks
• Branch Protection - Prevents direct commits to main

---

📞 Questions?

If you have questions about this security policy, please open a discussion or contact the maintainers.

---

Last Updated: November 2025