Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please use GitHub's private vulnerability reporting to submit your report.

You can expect:

Acknowledgment within 48 hours
Status update within 7 days
Resolution timeline based on severity

Supported Versions

Only the latest version on the main branch is actively maintained.

Security Measures

This project uses:

GitHub Dependabot for automated dependency updates
GitHub secret scanning with push protection
Pinned GitHub Actions (commit SHA, not mutable tags)

There aren't any published security advisories