# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in Mymir, please report it responsibly.

**Do not open a public issue.**

Instead, use [GitHub's private vulnerability reporting](https://github.com/FrkAk/mymir/security/advisories/new) to submit your report. This ensures the issue can be addressed before public disclosure.

## What to include

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

## Response

You can expect an initial response within 72 hours. We will work with you to understand and resolve the issue before any public disclosure.

## Scope

This policy applies to the latest version of Mymir on the `main` branch.
