# Security Policy
 
We support responsible disclosure and appreciate reports made in good faith.

## Scope

This policy applies to:

- security issues in this repository
- vulnerabilities in project dependencies or unsafe configurations
- incorrect handling of tokens, secrets, or CI workflows
- potential manipulation or bypass of provenance and verification mechanisms

The following are **not** in scope:

- general bugs that do not pose a security risk
- vulnerabilities in unrelated third-party tools or libraries

## How to Report a Vulnerability

Please report security concerns privately using **GitHub's Private Vulnerability Report** feature:

1. Navigate to this repository
2. Go to **Security** / **Report a vulnerability**
3. Submit the details privately

This ensures the issue is not publicly visible while it is being reviewed.

If the repository does not support this feature, you may instead create a private GitHub Security Advisory draft.

## Response Expectations

We aim to:

- acknowledge receipt of your report within **5 business days**
- provide an initial assessment within **10 business days**
- prepare fixes or further investigation as appropriate

When possible, we will credit reporters for responsible disclosure.

## Safe Harbor

We welcome good-faith security research.  
If you follow this policy, avoid intentionally causing harm, and respect privacy, we are unlikely to pursue legal action.

Thank you for supporting the integrity and safety of this project.
