# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in CogniWall, please report it responsibly.

**Email:** [cogniwall@gmail.com](mailto:cogniwall@gmail.com)

Include:
- A description of the vulnerability
- Steps to reproduce
- Impact assessment (if known)
- Any suggested fix (optional)

**Do not** open a public GitHub issue for security vulnerabilities.

## Response Timeline

- **Acknowledgment:** within 48 hours
- **Initial assessment:** within 1 week
- **Fix or mitigation:** as soon as feasible, typically within 30 days

We will coordinate disclosure with you and credit you in the release notes (unless you prefer to remain anonymous).

## Supported Versions

| Version | Supported |
|---------|-----------|
| 0.1.x   | Yes       |

## Scope

This policy covers the `cogniwall` Python package and the self-hosted dashboard in the `dashboard/` directory. Third-party dependencies are out of scope but we appreciate reports about vulnerable transitive dependencies.
