# Security Policy

## Reporting a vulnerability

Please do not open a public issue for security vulnerabilities.

Report vulnerabilities privately by contacting the maintainer through GitHub private security advisories or direct email.
Include:

- A clear description of the issue
- Reproduction steps or proof-of-concept
- Impact assessment
- Suggested mitigation (if available)

## Response expectations

- Initial response target: within 7 days
- Fix timeline depends on severity and complexity
- Coordinated disclosure preferred after a fix is available