If you discover a security vulnerability in Boutquin.Market, report it responsibly.

Do not open a public issue for security vulnerabilities.

Please use GitHub Security Advisories to report vulnerabilities privately: https://github.com/boutquin/Boutquin.Market/security/advisories/new

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: within 48 hours
• Initial assessment: within 7 days
• Fix or mitigation: target within 30 days, depending on severity

This policy covers Boutquin.Market NuGet packages and source code. Third-party dependencies (for example .NET runtime and NuGet dependencies) should be reported to their maintainers.