If you discover a security vulnerability in this project, please report it responsibly:

1. Do NOT create a public GitHub issue for security vulnerabilities
2. Email the maintainer directly or use GitHub's private vulnerability reporting feature
3. Include as much detail as possible:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Resolution Target: Within 30 days for critical issues

This project implements the following security measures:

• Dependency scanning via Dependabot
• Secret scanning enabled
• Code scanning (where applicable)
• Signed commits required from maintainers

• We follow coordinated disclosure
• Security patches will be released as soon as possible
• Credit will be given to reporters (unless anonymity is requested)