# Security Policy

## Supported Versions

We support the latest version of the library with security updates. Please ensure you're using the most recent release.

## Reporting a Vulnerability

If you discover a security vulnerability in this project, please follow these steps:

1. **Do not open a public issue** - this could expose the vulnerability to others
2. Contact the maintainers directly at [shawn@shawngrover.ca](mailto:shawn@shawngrover.ca)
3. Provide a detailed description of the vulnerability
4. Include steps to reproduce if possible
5. Allow time for a fix to be implemented and released

We take security seriously and will respond to legitimate reports promptly.

## Preferred Languages

We prefer all communications to be in English.

## Disclosure Process

Once a security issue is reported:
1. We will acknowledge receipt of the report within 48 hours
2. We will investigate and validate the issue
3. We will work on a fix and test it thoroughly
4. We will coordinate with the reporter on the disclosure timeline
5. We will release the fix and publicly acknowledge the reporter (unless anonymity is requested)

## Scope

This security policy applies to the `eldercrank-stripe-core` library.

## Dependencies

We strive to keep our dependencies secure and up-to-date. If you find a vulnerability in one of our dependencies that affects our project, please report it following the same process.
