# Security Policy

This file mirrors the GitHub-facing entry points for security disclosure.
The canonical security policy lives at [`SECURITY.md`](../SECURITY.md) in
the repository root.

## Reporting a vulnerability

1. Do not open a public issue.
2. Email [security@peacprotocol.org](mailto:security@peacprotocol.org) or
   open a private advisory at
   <https://github.com/peacprotocol/peac/security/advisories>.
3. Include affected versions, reproducer, observed versus expected
   behavior, and your impact assessment.

Acknowledgement targets:

- Critical: 48 hours.
- High: 72 hours.
- Medium: 7 days.
- Low: 14 days.

Patch-and-disclosure timelines, supply-chain attestations, and the full
trust-artifact index are documented in the canonical
[`SECURITY.md`](../SECURITY.md).

## Supported versions

See [`SECURITY.md`: Supported versions](../SECURITY.md#supported-versions)
for the authoritative list.

## Trust artifacts

- [Threat model](../docs/THREAT_MODEL.md).
- [Stability contract](../docs/STABILITY-CONTRACT.md).
- [SLO](../docs/SLO.md).
- [Security operations](../docs/SECURITY-OPERATIONS.md).
- [Trust artifacts](../docs/TRUST-ARTIFACTS.md).
