# Security Policy

## Reporting a vulnerability

Please email the maintainers privately or use GitHub Security Advisories. We prefer encrypted reports when possible.

Include: affected versions, reproduction, impact, and proposed mitigations.

We aim to acknowledge within 72 hours and provide a remediation timeline.

## Embargo and disclosure

- Coordinated disclosure preferred.
- We will assign a CVE via GitHub Advisories when appropriate.
- Fixes are released with signed tags and SBOM.


