| # Security Policy | |
| ## Supported Versions | |
| This repository is currently in beta. | |
| Security fixes are handled on the latest `main` branch. | |
| ## Reporting a Vulnerability | |
| Please report vulnerabilities privately to: | |
| - Robin@veristatesystems.com | |
| Include: | |
| - Affected component/file | |
| - Reproduction steps | |
| - Impact assessment | |
| - Suggested remediation (if available) | |
| ## Disclosure Policy | |
| - Please do not open public issues for unpatched vulnerabilities. | |
| - We aim to acknowledge reports quickly and coordinate responsible disclosure. | |
| ## Security Best Practices for Users | |
| - Do not commit secrets, credentials, or private data. | |
| - Use environment variables for sensitive configuration. | |
| - Rotate any credential immediately if accidental exposure is suspected. | |
| - Keep dependencies and runtime images updated. | |