# Security Policy

## Supported Versions

| Version | Supported |
| ------- | --------- |
| 0.1.x   | Yes       |

## Reporting a Vulnerability

If you discover a security vulnerability, please report it
responsibly:

1. **Do NOT open a public issue.** Security issues must be reported
   privately.
2. **Use [GitHub Security Advisories](https://github.com/moabualruz/crispy-tivi/security/advisories/new)**
   to report the vulnerability privately, or contact the maintainer
   on [Twitter / X](https://x.com/TheRiceFather) with a brief
   description. Include steps to reproduce and any relevant logs.
3. **Allow reasonable time** for the team to investigate and release
   a fix before any public disclosure.

We aim to acknowledge reports within 48 hours and provide a fix or
mitigation within 7 days for critical issues.

## Security Best Practices

This project follows these security practices:

- No secrets or API keys are committed to the repository
- Dependencies are regularly audited for known vulnerabilities
- User input is validated and sanitized at system boundaries
- Platform-specific security features (sandboxing, permissions)
  are used where available
