We are currently in beta. Security updates are provided for the latest beta release.

Note: Once we reach 1.0.0 stable, we will provide long-term security support for stable releases.

We use GitHub's private vulnerability reporting.

1. Go to the Security tab
2. Click "Report a vulnerability"
3. Provide detailed information:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

Response Time: You should receive a response within 48 hours.

We prefer all communications to be in English.

1. Report received - Security issue is reported and acknowledged within 48 hours
2. Triage - Issue is confirmed and severity assessed (24-72 hours)
3. Fix development - Fix is developed in a private repository
4. Testing - Fix is tested thoroughly against the vulnerability
5. Advisory - Security advisory is drafted and reviewed
6. Release - Patch is released with security fix
7. Notification - Users are notified via:
   • GitHub Security Advisory
   • Release notes
   • npm security advisory
   • GitHub Discussions announcement

We follow the Common Vulnerability Scoring System (CVSS):

• Critical (9.0-10.0): Immediate patch release
• High (7.0-8.9): Patch within 7 days
• Medium (4.0-6.9): Patch within 30 days
• Low (0.1-3.9): Patch in next regular release

We don't currently have a bug bounty program, but we appreciate responsible disclosure and will:

• Acknowledge security researchers in our release notes
• Credit you in the security advisory (if desired)
• Provide early notification of the fix