# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 0.2.x   | Yes       |
| < 0.2   | No        |

## Reporting a Vulnerability

If you discover a security vulnerability in Orxaq, please report it responsibly.

**Do NOT open a public GitHub issue for security vulnerabilities.**

Instead, email **security@orxaq.com** with:

1. A description of the vulnerability
2. Steps to reproduce
3. Affected versions
4. Any potential impact assessment

We will acknowledge receipt within 48 hours and provide an estimated timeline for a fix within 5 business days.

## Security Measures

Orxaq implements multiple layers of security:

- **Zero runtime dependencies**: Ring 1 (Kernel) uses only Python stdlib, minimizing supply chain risk
- **Hash-chained audit log**: Every operation is recorded with cryptographic integrity verification
- **Pre-commit hooks**: Automated secret scanning, SAST via Bandit, dependency vulnerability checks
- **CI pipeline**: Bandit SAST, Safety dependency scan, secret detection on every PR
- **Docker**: Non-root container user, minimal base image (python:3.12-slim)

## Dependency Policy

- Ring 1 (Kernel): **Zero** external dependencies --- stdlib only
- Ring 2-5: Optional dependencies declared in `pyproject.toml` under `[project.optional-dependencies]`
- All dependencies pinned to minimum compatible versions
- Safety dependency vulnerability scanner runs in CI
