# HieraChain Security Policy

## Reporting a Security Bug

If you think you have discovered a security issue in the HieraChain project, I'd love to hear from you. I will take all security bugs seriously and if confirmed upon investigation I will patch it within a reasonable amount of time and release a public security bulletin discussing the impact and credit the discoverer.

To report a security bug, file a confidential security bug in the repository's [security advisories page](https://github.com/VanDung-dev/HieraChain/security). Guidance can be found in the GitHub documentation on [privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).

The process by which security bugs are handled is documented further in the Defect Response process.

---

## Security Vulnerability Response

When a security report is received, I will:

1. Confirm the issue and assign a severity level
2. Develop a fix and prepare a patch
3. Notify affected users (if applicable)
4. Release the patch and publish a security advisory

---

## Contributing to the Project

For general issues, feature requests, or discussions, please use the regular `GitHub Issues`. **However, please do not report security vulnerabilities through public issues.**

If you'd like to contribute code fixes or enhancements, you can submit `Pull Requests`. For security-related fixes, please coordinate through the security advisories process first before submitting a pull request.

Learn more about the difference between [GitHub Issues](https://docs.github.com/en/issues/tracking-your-work-with-issues/about-issues), [Security Advisories](https://docs.github.com/en/code-security/security-advisories/about-github-security-advisories), and [Pull Requests](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests) in the GitHub documentation.

---
