# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 1.1.x   | :white_check_mark: |
| 1.0.x   | :white_check_mark: |
| < 1.0   | :x:                |

## Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

1. **Do NOT** open a public GitHub issue
2. Email **security@dev-suite.dev** or use [GitHub Private Vulnerability Reporting](https://github.com/claude-dev-suite/claude-dev-suite/security/advisories/new)
3. Include steps to reproduce if possible
4. Allow reasonable time for a fix before public disclosure

## Security Best Practices

When using dev-suite:

- Never commit sensitive credentials to version control
- Use environment variables for API tokens and database URLs
- Review MCP server permissions before enabling
- Keep dependencies updated

## Response Timeline

- Initial response: within 48 hours
- Status update: within 7 days
- Fix timeline: depends on severity
