# Security Policy

## Supported Versions

| Version | Supported |
| ------- | ---------- |
| 0.1.x   | ✅ |

## Reporting a Vulnerability

We take security vulnerabilities seriously. If you discover a security issue:

1. **Do not** open a public GitHub issue
2. Email security concerns to the maintainers via GitHub's private vulnerability reporting
3. Include:
   - Description of the vulnerability
   - Steps to reproduce
   - Potential impact
   - Suggested fix (if available)

## Response Timeline

- **Acknowledgment**: Within 48 hours
- **Initial assessment**: Within 5 business days
- **Patch target**: Within 90 days

## Dependency Security

We use `cargo audit` in CI to scan for known vulnerabilities in dependencies.

## Secret Scanning

We use [gitleaks](https://github.com/gitleaks/gitleaks) in CI to detect accidentally committed secrets, API keys, and credentials.
