# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 3.15.x  | ✅ Supported       |
| < 3.15  | ❌ Not Supported   |

## Reporting a Vulnerability

**Do not** open a public issue to report a security vulnerability.

Instead, please email the maintainers at **sanjibroy17061995@gmail.com** with:

1. **Description** of the vulnerability
2. **Steps to reproduce** (if applicable)
3. **Potential impact** of the vulnerability
4. **Suggested fix** (if you have one)

We will acknowledge your report within 24 hours and work to address the issue as quickly as possible.

## Security Considerations

### Authentication

- **GitHub Token**: Use a personal access token with minimal required scopes
- **Environment Variables**: Never commit `.env` files to version control
- **API Keys**: Treat all API keys as secrets and rotate regularly

### Data Protection

- All API communications use HTTPS
- Avoid logging sensitive information (API keys, tokens, passwords)
- Clear temporary files and backups after processing

### Dependency Security

- We regularly update dependencies to patch known vulnerabilities
- Use `npm audit` to check your installation for vulnerabilities
- Report any dependency issues to the maintainers

### Best Practices

1. Keep your Node.js and npm versions updated
2. Use the `--force` flag with caution when installing packages
3. Review the `.npmignore` to understand what data is included
4. Monitor GitHub releases for security updates

## Vulnerability Disclosure Timeline

- **Day 0**: Vulnerability reported
- **Day 1**: Acknowledgment sent
- **Day 7**: Update on fix status
- **Day 30**: Public disclosure (after fix release)

We appreciate responsible vulnerability disclosure and will credit the reporter in the security advisory.

## Security Headers

- **X-Content-Type-Options**: nosniff
- **X-Frame-Options**: DENY
- **Strict-Transport-Security**: max-age=31536000; includeSubDomains

For security concerns, contact: **sanjibroy17061995@gmail.com**