# Security Policy

## Supported Versions

We release security updates for the following versions:

| Version | Supported          |
| ------- | ------------------ |
| 1.0.x   | :white_check_mark: |
| < 1.0   | :x:                |

## Reporting a Vulnerability

**Please do not report security vulnerabilities through public GitLab issues.**

Instead, please report security issues via email to: **oss@tivision.dev**

### What to Include

When reporting a vulnerability, please include:

- **Description**: A clear description of the vulnerability
- **Impact**: What can be compromised or affected
- **Reproduction Steps**: Detailed steps to reproduce the issue
- **Proof of Concept**: Code or configuration that demonstrates the issue
- **Suggested Fix**: If you have ideas for fixing it (optional)
- **Environment**: Python version, OS, package version

### Response Timeline

- **Initial Response**: Within 48 hours
- **Status Update**: Within 7 days
- **Fix Timeline**: Depends on severity
  - Critical: 7-14 days
  - High: 14-30 days
  - Medium: 30-60 days
  - Low: Best effort

### Security Update Process

1. We will confirm receipt of your report
2. We will investigate and validate the issue
3. We will develop and test a fix
4. We will release a security patch
5. We will credit you in the security advisory (unless you prefer to remain anonymous)

### Security Best Practices

When using Cynapse:

- Always use the latest version
- Review baseline integrity before trusting it
- Use appropriate protection levels for your security requirements
- Don't disable security features in production
- Monitor logs for tamper detection events
- Keep your Python environment updated

## Past Security Advisories

No security advisories have been published yet.

## Contact

- **Email**: oss@tivision.dev
- **PGP Key**: (Will be provided upon request)

Thank you for helping keep Cynapse and its users safe!
