We take security seriously. If you discover a security vulnerability in this project, please follow these guidelines to report it responsibly.

• Do not open a public GitHub issue for the security vulnerability
• Do not disclose the vulnerability on social media
• Do not share details about the vulnerability without permission

1. Report to Security Team: Send a detailed report to security@example.com

   Include:

   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if available)

2. Wait for Response: We will acknowledge receipt within 48 hours and keep you updated on our investigation

3. Embargo Period: We request a reasonable embargo period (typically 90 days) before public disclosure to allow time for fixing

When using this project template:

• Keep dependencies up to date: npm audit and npm update
• Review security advisories regularly
• Use environment variables for sensitive data
• Enable branch protection and require code reviews
• Implement proper authentication and authorization
• Use HTTPS for all communications
• Encrypt sensitive data at rest and in transit

• Security updates will be released as patches (1.0.x)
• Critical vulnerabilities will receive priority fixes
• Security advisories will be posted alongside updates

We use the following tools and practices:

• Dependabot for dependency scanning
• GitHub security advisories
• Regular code reviews
• Static code analysis
• Community vulnerability reports

• Security Team: security@example.com
• Maintainers: @project-maintainers

Thank you for helping keep this project secure!