# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in GT Office, please report it responsibly:

- **Email:** opensource@gtoffice.dev
- **Do not** file a public GitHub issue for security vulnerabilities.

We ask that you:

1. Report vulnerabilities privately via the email above.
2. Provide enough detail to reproduce the issue.
3. Allow us a reasonable time to respond and fix before any public disclosure.

## Response Timeline

- **Acknowledgment:** Within 48 hours
- **Initial assessment:** Within 5 business days
- **Fix & disclosure:** We will coordinate a timeline with you after assessment

## Supported Versions

Security updates are applied to the latest release. We do not backport fixes to older versions.

## Responsible Disclosure

We appreciate responsible disclosure and will credit researchers who report vulnerabilities (unless you prefer to remain anonymous).