# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 3.0.x   | :white_check_mark: |
| 2.x.x   | :x: (deprecated)   |
| 1.x.x   | :x: (deprecated)   |

## Reporting a Vulnerability

If you discover a security vulnerability, please report it privately:

1. **Email**: security@swd-axios-query.com
2. **GitHub Security Advisory**: Use GitHub's private vulnerability reporting
3. **Do NOT** create public issues for security vulnerabilities

## Security Measures

This package implements several security measures:

### Supply Chain Security
- ✅ **audit-ci** integration for automated vulnerability scanning
- ✅ **only-allow** to enforce npm usage
- ✅ **preinstall** and **postinstall** hooks for security checks
- ✅ **packageManager** field to lock npm version
- ✅ **engines** field to specify Node.js and npm requirements

### Code Security
- ✅ **ESLint** with security-focused rules
- ✅ **Jest** testing framework with security test patterns
- ✅ **Babel** transpilation with security considerations
- ✅ **No eval()** or dangerous code patterns

### Dependencies
- ✅ **Minimal dependencies** - only essential packages
- ✅ **Regular security audits** via npm audit
- ✅ **Peer dependencies** for React to avoid version conflicts
- ✅ **Exact version pinning** for critical security packages

## Security Best Practices

### For Users
1. **Keep dependencies updated**: Run `npm audit` regularly
2. **Use exact versions**: Pin critical dependencies
3. **Review code**: Always review third-party code before use
4. **Report issues**: Report security issues privately

### For Contributors
1. **Security review**: All PRs require security review
2. **Dependency audit**: New dependencies must pass security audit
3. **Testing**: Security-related changes require additional testing
4. **Documentation**: Security changes must be documented

## Vulnerability Response

1. **Acknowledgment**: We will acknowledge receipt within 24 hours
2. **Assessment**: We will assess the vulnerability within 72 hours
3. **Fix**: We will provide a fix within 7 days for critical issues
4. **Disclosure**: We will coordinate disclosure with the reporter

## Security Tools

This package uses the following security tools:

- **audit-ci**: Automated vulnerability scanning
- **ESLint**: Code quality and security linting
- **Jest**: Security-focused testing
- **npm audit**: Dependency vulnerability scanning
- **only-allow**: Package manager enforcement

## Contact

For security-related questions or concerns:
- **Email**: security@swd-axios-query.com
- **GitHub**: [Security Advisory](https://github.com/waboasiako/swd-axios-query/security/advisories)

---

**Thank you for helping keep this project secure!**