# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in Dev Machine Guard, please report it responsibly.

**Do NOT open a public GitHub issue for security vulnerabilities.**

Instead, please email: **security@stepsecurity.io**

Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

We will acknowledge your report within 48 hours and provide a detailed response within 5 business days.

## Scope

This policy covers:
- The `stepsecurity-dev-machine-guard` binary and Go source code in `internal/`
- The StepSecurity backend API (for enterprise mode)

## Supported Versions

| Version | Supported |
|---------|-----------|
| Latest  | Yes       |
| < Latest| No        |

We recommend always using the latest release.
