# Security Policy

## Reporting Vulnerabilities

If you discover a security vulnerability in ContextGuard, please **do not** open a public issue. Instead, please report it responsibly by emailing **jasht.developer+contextguard** (or open a private security advisory if this project is on GitHub).

### What to include in your report:
- Description of the vulnerability
- Steps to reproduce (if applicable)
- Potential impact
- Suggested fix (if you have one)

### Our commitment:
- We will acknowledge your report within 48 hours
- We will provide a status update within 5 business days
- We will credit you in the security advisory (unless you prefer anonymity)
- We will work with you to ensure a responsible disclosure timeline

## Scope
Security vulnerabilities may include:
- Input validation bypasses (e.g., evading injection detection)
- Information disclosure (e.g., leaking audit logs)
- Denial of service (e.g., resource exhaustion)
- Cryptographic weaknesses (if any)
- Third-party dependency vulnerabilities (we'll update ASAP)

## Out of Scope
- Social engineering
- Physical security
- Issues in third-party libraries (please report to the library maintainers)
- Design limitations (e.g., regex-based detection is fundamentally not ML-grade)

## Security Best Practices

When using ContextGuard:
- **Always** review the `detected_categories` in `ScanResult` — they indicate what type of risk was found
- **Set an appropriate `block_threshold`** for your use case (default: 0.9 is conservative)
- **Monitor audit logs** regularly for patterns
- **Keep dependencies updated** (`pip install --upgrade contextguard-ai`)
- **Test with your actual LLM prompts** before deploying to production

---

Thank you for helping keep ContextGuard secure! 🛡️
