# Security Policy

## Reporting a vulnerability

Do not open a public issue for a vulnerability that could expose credentials, sensitive artifacts, repository access, or a practical bypass of a security invariant. Use the private contact channel published by the dTech Technology and Research Initiative and include the affected version, reproduction steps, impact, and a safe proof of concept.

Do not include live credentials, personal data, proprietary artifacts, or weaponized payloads. Maintainers will acknowledge a complete report, coordinate validation and remediation, and publish a disclosure when affected users can act safely.

## Supported versions

The project is pre-alpha. Security fixes target the latest `main` revision until the first tagged release policy is published.

## Safe-use notice

AAISA findings require human review. A clean report does not establish that a system is secure. Generated reports may disclose file paths and security context and should be stored and shared accordingly.