SECURITY.md

# Security Policy

## Reporting a Vulnerability

Please **do not** open a public issue for security vulnerabilities. Instead,
report them privately to the maintainers so they can be triaged and fixed
before disclosure.

Include in your report:

- A description of the vulnerability and the affected endpoints/components.
- Steps to reproduce (if possible).
- Impact assessment.

## Supported Versions

Security fixes are backported to the latest stable release. Older versions are
not actively patched — please upgrade to the current release.

## Known Scope

This project runs a public JSON API and an admin dashboard. A current threat
model and mitigation checklist is maintained in
[docs/SECURITY.md](docs/SECURITY.md) — please review it before deploying to an
untrusted network.

## Disclosure Timeline

- **Acknowledgement** — within 72 hours of the report.
- **Fix** — a patched release is published as soon as the fix is verified.
- **Disclosure** — public mention of the vulnerability after the fix ships.