# Security Policy

If you discover a security vulnerability, please report it responsibly so we can address it before public disclosure.

## Reporting a vulnerability

Please **do not** open a public GitHub issue for security reports.

Preferred reporting method (private):
- Use GitHub’s **“Report a vulnerability”** / **Security Advisory** workflow on the AbstractFramework monorepo (covers AbstractMemory and related packages):
  - `https://github.com/lpalbou/AbstractFramework`

If private reporting is not available on the repository:
- Contact the maintainers privately via the repository’s contact channels (e.g. GitHub profile contact).

## What to include

To help us triage quickly, include:
- A clear description of the issue and potential impact
- The affected component(s) and file paths (if known)
- Steps to reproduce (or a minimal proof-of-concept)
- The version(s) impacted (see `pyproject.toml`) and your environment details
- Any suggested mitigation or patch (optional)

## Disclosure timeline

We will do our best to acknowledge receipt promptly and work with you on a coordinated disclosure timeline.

Thank you for helping keep users safe.
