# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in AIMEAT, please report it responsibly.

**DO NOT** open a public GitHub issue for security vulnerabilities.

Instead, email: **jouni.miikki@overscalesolutions.com**

Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

## Response Timeline

- **Acknowledgment:** within 48 hours
- **Initial assessment:** within 1 week
- **Fix or mitigation:** depends on severity, typically within 2 weeks for critical issues

## Scope

This policy covers the AIMEAT reference implementation (`aimeat/` directory) and the protocol specification.

## Supported Versions

| Version | Supported |
|---------|-----------|
| 1.2.x   | Yes       |
| < 1.2   | No        |
