# Security Policy

## Reporting Security Vulnerabilities

If you discover a security vulnerability, please email security@revenium.io.

Do not create public GitHub issues for security vulnerabilities. We appreciate your responsible disclosure and will acknowledge your contribution after the issue is resolved.

## Supported Versions

We release patches for security vulnerabilities in the following versions:

- Latest release version
- Previous minor version (if less than 6 months old)

## Security Update Process

1. The reported issue will be acknowledged within 48 hours
2. We will investigate and validate the reported vulnerability
3. A fix will be developed and tested
4. A security update will be released as soon as possible
5. Credit will be given to the reporter (unless anonymity is requested)

## Best Practices

When using this middleware:

- Keep your dependencies up to date
- Never commit API keys or credentials to version control
- Use environment variables for sensitive configuration
- Follow the principle of least privilege for API access