# Security Policy

## Reporting a Vulnerability

**Do not open a public GitHub issue for security vulnerabilities.**

Email **security@anatomia.dev** with:

- Description of the vulnerability
- Steps to reproduce
- Affected versions
- Any potential impact you've identified

## Response Timeline

- **Acknowledgment:** within 48 hours
- **Initial assessment:** within 5 business days
- **Fix or mitigation:** dependent on severity, but we aim for 30 days for critical issues

## Scope

This policy covers the `anatomia-cli` npm package and its direct dependencies. It does not cover:

- The marketing website (anatomia.dev)
- Third-party integrations or plugins
- Issues in upstream dependencies (report those to the upstream maintainer)

## Safe Harbor

We will not pursue legal action against researchers who:

- Report vulnerabilities through the email channel above
- Make a good-faith effort to avoid data destruction or service disruption
- Do not publicly disclose the vulnerability before a fix is available
