# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in any `@paretools` package, please report it responsibly.

**Do not open a public GitHub issue for security vulnerabilities.**

Report via **GitHub Private Vulnerability Reporting** — go to the [Security tab](https://github.com/Dave-London/Pare/security/advisories/new) and click "Report a vulnerability".

Include:

- Which package is affected (`@paretools/git`, `@paretools/test`, etc.)
- A description of the vulnerability
- Steps to reproduce (if applicable)

## Response Timeline

- **Acknowledgement**: Within 48 hours
- **Assessment**: Within 1 week
- **Fix**: Depends on severity, but we aim for patches within 2 weeks for critical issues

## Scope

This policy covers all packages published under the `@paretools` npm scope.

## Security Audits

- [February 2026 Audit](docs/security/audit-2026-02-12.md) — 18 findings, 14 remediated, 4 accepted risk

## Supported Versions

| Package                 | Supported |
| ----------------------- | --------- |
| `@paretools/*` >= 0.2.0 | Yes       |
