# Security Policy

## Reporting a vulnerability

Please do not open public issues for security vulnerabilities.

Preferred: open a GitHub Security Advisory for this repository and include:
- a description of the issue and impact
- steps to reproduce (or a PoC)
- affected versions/commits if known

If you cannot use GitHub advisories, open a GitHub issue titled `SECURITY: request contact` and we’ll coordinate a private channel.

## Supported versions

This project is early-stage OSS. Security fixes are applied to `main` and shipped in the next tagged release.
