SECURITY.md

Rama main · réplica de lectura del repositorio original.

# Security Policy

Security is important to the **attic** project. We appreciate the efforts of security researchers and community members who help identify and responsibly disclose vulnerabilities.

## Reporting a Vulnerability

If you discover a potential security vulnerability in attic, please report it privately so we can investigate and address it before public disclosure.

**Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**

Instead, use GitHub's private vulnerability reporting feature:

**[Report a Security Vulnerability](https://github.com/lmmendes/attic/security/advisories/new)**

## Response and Resolution

We aim to handle vulnerability reports promptly and transparently while prioritizing the security of our users.

| Stage | Target Timeline |
|---|---|
| **Acknowledgment** | Within 48–72 hours |
| **Initial Assessment** | Within 7 days |
| **Resolution** | Based on severity, impact, and complexity |
| **Disclosure** | Coordinated after a fix or mitigation is available, whenever possible |

These timelines are best-effort targets and may vary depending on maintainer availability and the complexity of the reported issue.

We will make reasonable efforts to keep reporters informed of significant progress throughout the investigation and remediation process.

## Security Updates

Security fixes are distributed through the project's normal release process.

Users are encouraged to monitor the repository's [GitHub Security Advisories](https://github.com/lmmendes/attic/security/advisories) and keep their installations updated.

## License

attic is licensed under the [MIT License](LICENSE.md).