SECURITY.md

Rama master · réplica de lectura del repositorio original.

<!-- SPDX-License-Identifier: FSL-1.1-Apache-2.0 -->

# Security Policy

## Supported versions

During pre-1.0, only the latest tagged release is supported with
security fixes. From 1.0 onward, an LTS policy will be defined in
the project plan (`plan.md` §∞.6).

## Reporting a vulnerability

**Do not open a public GitHub issue for security reports.** Please
report vulnerabilities privately to **security@apprafter.dev**
(placeholder until a real address is provisioned). Include:

- A description of the issue and its impact.
- Steps to reproduce, with minimal manifests / commands.
- The affected version (`apprafter version` output, or the
  commit SHA if running from source).
- Any suggested mitigation.

We aim to:

- Acknowledge reports within **72 hours**.
- Provide an initial assessment within **7 days**.
- Coordinate disclosure timing with the reporter; default
  embargo window is **90 days**.

## PGP

A PGP key for the security team will be published here once the
team is established. Until then, request encrypted communication
via the email address above and we will provide a key.

## Hall of fame

Once the platform reaches 1.0 and a bug-bounty programme is in
place, valid reports will be credited here unless the reporter
prefers anonymity.