# Security Policy

## Reporting a Vulnerability

We take security vulnerabilities seriously. If you discover a security issue, please report it to us by following these steps:

1. On GitHub, navigate to the main page of the repository.
2. Under the repository name, click the **Security** tab.
3. Click **Report a vulnerability** to open the advisory form.
4. Fill in the form with as much detail as possible.

We will do our best to respond to your report within 48 hours.

## Security Standards

This project adheres to the [Positronikal Repository Security Rules](https://github.com/Positronikal/PositronikalCodingStandards/blob/main/standards/Repository%20Security%20Rules.md). Please refer to these rules for more information on our security practices.

## Disclosure Policy

### Response Timeline

- **Initial Response**: Within 48 hours of report
- **Severity Assessment**: Within 72 hours
- **Patch Development**: Critical issues within 7 days, others within 30 days
- **Public Disclosure**: After patch is available and deployed

### Severity Classification

- **Critical**: Remote code execution, privilege escalation, data breach
- **High**: Shell injection, path traversal, authentication bypass
- **Medium**: Information disclosure, denial of service
- **Low**: Minor security improvements

### Coordinated Disclosure

We practice responsible disclosure and request that reporters:
- Allow reasonable time for patching before public disclosure
- Avoid testing on production systems without authorization
- Do not exploit vulnerabilities beyond proof-of-concept
- Coordinate disclosure timing with maintainers