# Security Policy

## Reporting a Vulnerability
- Please email the maintainers or open a **confidential** security issue (do not file a public issue for unconfirmed vulnerabilities).
- Include reproduction steps, affected versions, and any logs you can share safely.
- We aim to acknowledge within 72 hours and provide a timeline for remediation.

## Scope
- Code in this repository and published PyPI packages.
- Security of dependencies should be reported upstream; we will update/patch as needed.

## Responsible Disclosure
- Please give us a reasonable window to investigate and release fixes before public disclosure.

