# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| Current main branch | ✅ |
| Latest release | ✅ |
| Older releases | ❌ |

## Reporting a Vulnerability

If you discover a security vulnerability in bevy-i18n-lint, please report it privately to us.

### How to Report

1. **Send a private report via GitHub Security Advisories**
   - Go to [Security Advisories](https://github.com/pas7-studio/bevy-i18n-lint/security/advisories)
   - Click "Report a vulnerability"
   - Fill in the details with as much information as possible

2. **Alternatively, email the maintainers**
   - Use the contact information provided in the project repository

### What to Include

- Description of the vulnerability
- Steps to reproduce the issue
- Potential impact of the vulnerability
- Any suggested fixes or workarounds
- Your GitHub username for credit (optional)

### What Happens Next

1. We will acknowledge receipt of your report within 48 hours
2. We will investigate and assess the severity of the vulnerability
3. We will work on a fix and coordinate the disclosure timeline with you
4. Once a fix is ready, we will release a security advisory and patch

## Security Best Practices

- Keep your dependencies updated
- Review the security advisories for dependencies
- Follow best practices for handling internationalization data
- Validate and sanitize all inputs

### Disclosure Policy

We follow a 90-day disclosure timeline:
- We aim to fix and release patches within 90 days of initial report
- We may adjust this timeline based on severity and complexity
- We will credit reporters (with permission) in security advisories

Thank you for helping keep bevy-i18n-lint secure!