# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 0.1.x   | Yes                |

## Reporting a Vulnerability

If you discover a security vulnerability in PyAuthz, please report it responsibly.

**Do NOT open a public GitHub issue for security vulnerabilities.**

Instead, please email security concerns to the maintainers directly. Include:

1. A description of the vulnerability
2. Steps to reproduce
3. The potential impact
4. Any suggested fixes (optional)

We will acknowledge receipt within 48 hours and aim to provide a fix within 7 days for critical issues.

## Security Design Principles

PyAuthz follows these security principles by design:

- **Deny by default** — when no policy matches a request, access is denied
- **Fail loud on load** — invalid policies, missing roles, and schema errors raise exceptions at configuration time
- **Fail safe on evaluate** — missing attributes during evaluation produce DENY decisions, never crashes
- **No custom DSL** — policies are Python objects or YAML, reducing parser attack surface
- **Minimal dependencies** — core library depends only on Pydantic and PyYAML
- **Type safety** — full type hints and Pydantic validation on all inputs

## Scope

Security reports are relevant for:

- Policy evaluation bypasses (a request that should be denied is allowed)
- Denial of service through crafted policies or inputs
- Information leakage through error messages or audit logs
- YAML parsing vulnerabilities (we use `yaml.safe_load` exclusively)
