# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 1.0.x (latest) | :white_check_mark: |
| < 1.0.4 | :x: |

## Reporting a Vulnerability

Open a **GitHub Issue** using the label `security`:

**[https://github.com/carlosmmairena/ldap-staff-directory/issues/new?labels=security](https://github.com/carlosmmairena/ldap-staff-directory/issues/new?labels=security)**

Please include in your report:
- Description of the vulnerability and its potential impact
- Steps to reproduce or a proof-of-concept
- Affected version(s)
- Any suggested mitigation (optional)

### Response timeline

| Event | Target |
|---|---|
| Acknowledgement | 48 hours |
| Status update | 7 days |
| Patch release (confirmed issues) | 30 days |

## Security Analysis

A static security analysis of the codebase (findings, deployment checklists, infrastructure recommendations) is available at [`docs/security-analysis.md`](docs/security-analysis.md).