# Security Policy

We take the security of Voltro and the applications built on it seriously. This
document explains how to report a vulnerability and what to expect in return.

## Reporting a vulnerability

**Please do not open public issues or discuss suspected vulnerabilities in
public channels.** Report them privately by email:

**security contact: [support@voltro.dev](mailto:support@voltro.dev)**
(subject line: `SECURITY`).

Include, where you can:

- the affected package(s) and version(s) (e.g. `@voltro/runtime@x.y.z`);
- a description of the issue and its impact;
- a minimal reproduction or proof of concept;
- any suggested remediation.

If you'd like to encrypt your report, ask in a first plain email and we'll
arrange a key.

## What to expect

- **Acknowledgement** of your report within **3 business days**.
- An initial assessment (severity, affected surface) and a remediation plan as
  soon as we've reproduced the issue.
- **Coordinated disclosure:** we'll agree a disclosure timeline with you and
  credit you in the release notes if you wish. Please give us reasonable time to
  ship a fix before any public disclosure.

We do not currently run a paid bug-bounty program, but we genuinely appreciate
responsible disclosure and will credit reporters.

## Software Bill of Materials (SBOM)

A CycloneDX SBOM of the third-party runtime dependency graph is generated for the
published packages (`pnpm gen:sbom` → `sbom.cdx.json`). If your procurement or
security team needs it, request it at
[support@voltro.dev](mailto:support@voltro.dev).

## Supported versions

Voltro is pre-1.0 and ships in lockstep: **only the latest published minor of
each `@voltro/*` package receives security fixes.** Please upgrade to the latest
release before reporting, and pin exact versions in production.

## Scope

In scope: the published `@voltro/*` packages and the framework's own code.

Out of scope: vulnerabilities in third-party dependencies that are already
tracked upstream (we monitor these via a production-dependency audit gate in
CI), and issues that require a non-default, explicitly-unsafe configuration. If
you're unsure, report it anyway — we'd rather hear about it.