# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in this repository (`dmno-dev/varlock`), please follow these steps:

1. **Do not create a public issue.**
   - To protect users, please report vulnerabilities privately using GitHub's private reporting [feature](https://github.com/dmno-dev/varlock/security)
   - OR alternatively email: security@varlock.dev

3. **Include Relevant Details:**
   - Describe the vulnerability and potential impact.
   - Include steps to reproduce, if possible.
   - Suggest remediation or mitigation strategies if you have them.

## Supported Versions

| Version       | Supported          |
| ------------- | ------------------ |
| main/latest   | ✅                 |
| past releases | ❌                 |

We generally support the most recent release on the `main` branch. Older versions may not receive security updates.

## Disclosure Policy

- We aim to respond to vulnerability reports within **2 business days**.
- Once confirmed, we will work to resolve the issue and coordinate disclosure.
- You will be notified when the issue is resolved and if a public advisory will be published.

## Responsible Disclosure

We ask that you:
- Act in good faith and avoid data destruction or service disruption.
- Allow reasonable time for remediation before public disclosure.

Thank you for helping keep `varlock` and its users safe!
