# Security Policy

Adsum IoT Coder helps developers build, debug, and ship secure firmware — including EU Cyber
Resilience Act (CRA) readiness checks — so we take the security of the extension itself seriously.

## Supported versions

Security fixes are provided for the latest published release. Please upgrade to the most recent
version from the VS Code Marketplace or Open VSX before reporting.

| Version         | Supported |
| --------------- | --------- |
| 0.1.x (latest)  | ✅        |
| < 0.1.0         | ❌        |

## Reporting a vulnerability

**Please do not open a public issue for security vulnerabilities.**

Report privately through GitHub's private vulnerability reporting:
**Security → "Report a vulnerability"** on this repository
(<https://github.com/adsumnetworks/Adsum-IoT-Coder/security/advisories/new>).

If you are unable to use GitHub advisories, contact the maintainers at
`security@adsumnetworks.com`.

Please include:

- the affected version and platform (editor + OS),
- a description of the issue and its impact,
- steps to reproduce or a proof of concept,
- any suggested remediation.

## What to expect

- We aim to acknowledge a report within 3 business days.
- We will keep you informed of remediation progress and coordinate a disclosure timeline with you.
- With your consent, we will credit you in the release notes for the fix.

## Scope

This policy covers the Adsum IoT Coder extension and the code in this repository. Adsum IoT Coder is
a derivative work of [Cline](https://github.com/cline/cline) (Apache-2.0); vulnerabilities that
originate in upstream Cline code should also be reported to that project where appropriate.
