# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 0.0.x   | :white_check_mark: |

## Reporting a Vulnerability

We take the security of Confii seriously. If you discover a security vulnerability, please report it responsibly.

### How to Report

- **Email:** Contact the project owner at [confiify](https://github.com/confiify) via GitHub
- **GitHub Security Advisories:** Open a confidential report at [https://github.com/confiify/confii/security/advisories/new](https://github.com/confiify/confii/security/advisories/new)

**Please do NOT open a public GitHub issue for security vulnerabilities.**

### What to Expect

- **Acknowledgment:** You will receive an initial response within 48 hours confirming receipt of your report.
- **Assessment:** We will investigate and provide an assessment within 7 days.
- **Resolution:** If the vulnerability is accepted, we aim to release a fix within 30 days, depending on complexity.
- **Disclosure:** We will coordinate with you on public disclosure timing after a fix is available.

### What to Include

When reporting a vulnerability, please include:

- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any relevant logs, screenshots, or proof-of-concept code
- Your suggested severity level (low, medium, high, critical)
