# Security Policy

## Supported Releases

Security fixes are handled on the latest published release on PyPI and the current `main` branch.

## Reporting a Vulnerability

Please do not open a public GitHub issue for a suspected security problem.

Instead:

1. Open a private GitHub security advisory for this repository if that option is available to you.
2. If not, contact the project maintainer directly through a repository contact method and include enough detail to reproduce the issue safely.

If this repository later adds a dedicated security contact address, maintainers should update this file.

## What to Include

- Affected command or workflow
- Version or commit if known
- Reproduction steps
- Expected impact
- Any suggested mitigation

Please avoid posting API tokens, private workspace data, or other sensitive material in public.
