# Security Policy

## Reporting a vulnerability

Please report security issues **privately**.

Preferred channel:
- Use **GitHub Security Advisories** / the repository’s “Report a vulnerability” feature (private).

Include as much of the following as you can:
- affected versions (from `pyproject.toml` / `CHANGELOG.md`)
- impact and realistic attack scenario
- minimal reproduction steps or proof-of-concept
- environment details (OS, Python version, storage backend used)

## Coordinated disclosure

- Do not open public issues/PRs for security vulnerabilities.
- Avoid data exfiltration, service disruption, or destructive testing; keep verification to the minimum needed.

## Non-security bugs

If you are unsure whether an issue is security-related, prefer reporting it privately first.

