# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 0.1.x | Yes |

## Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

1. **Do not** open a public issue
2. Email **jamesyng79@gmail.com** with:
   - Description of the vulnerability
   - Steps to reproduce
   - Potential impact
3. You will receive an acknowledgment within 48 hours
4. A fix will be prioritized based on severity

## Security Measures

This project uses:
- **CodeQL** — static analysis on every push
- **Dependabot** — automated dependency updates

## Scope

The following are in scope:
- API credential exposure or mishandling
- Code injection vulnerabilities
- Dependency vulnerabilities with known exploits

Out of scope:
- Denial of service
- Social engineering
