# Security Policy

## Supported Versions

We release patches for security vulnerabilities for the following versions:

| Version | Supported          |
| ------- | ------------------ |
| 1.0.x   | :white_check_mark: |

## Reporting a Vulnerability

We take the security of embedded-agent-bridge seriously. If you discover a security vulnerability, please report it responsibly.

**Please do NOT report security vulnerabilities through public GitHub issues.**

Instead, please email security concerns to: **shanemmattner@gmail.com**

Please include the following information in your report:
- Type of vulnerability
- Full paths of source file(s) related to the vulnerability
- Location of the affected source code (tag/branch/commit or direct URL)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the vulnerability, including how an attacker might exploit it

### Response Timeline

- **72 hours**: We will acknowledge receipt of your vulnerability report
- **90 days**: We aim to release a fix within 90 days of disclosure

You will receive regular updates on the progress toward a fix and full announcement. We may ask for additional information or guidance during this process.

### Responsible Disclosure

We kindly ask that you:
- Allow us reasonable time to address the vulnerability before public disclosure
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services
- Only interact with accounts you own or with explicit permission of the account holder

## Attribution

We appreciate the security research community and will acknowledge your responsible disclosure in our release notes (unless you prefer to remain anonymous).
