# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in DepSec, please report it responsibly.

**Do NOT open a public issue.**

Instead, email: **security@chocksy.com**

Include:

- Description of the vulnerability
- Steps to reproduce
- Impact assessment
- Any suggested fix

## Response Time

- Acknowledgment: within 48 hours
- Initial assessment: within 7 days
- Fix timeline: depends on severity

## Scope

This policy covers:

- The `depsec` CLI binary
- The GitHub Action (`chocksy/depsec@v1`)
- The install script (`install.sh`)
- Detection patterns (false negatives that miss real attacks)

## Supported Versions

| Version | Supported |
|---------|-----------|
| latest  | Yes       |
| < latest | No       |
