SECURITY.md

Rama main · réplica de lectura del repositorio original.

<!-- SECURITY.md -->

# Security policy

## Report a vulnerability privately

Please **do not** report suspected vulnerabilities through public GitHub issues,
discussions, pull requests, or social media.

Email [security@wenet-ec.com](mailto:security@wenet-ec.com) with:

- a description of the issue and affected component/version;
- steps to reproduce or a proof of concept;
- impact assessment and any mitigations you have identified; and
- a secure contact method for follow-up.

We aim to acknowledge a report within 72 hours, validate the issue, coordinate
a fix and disclosure timeline, and credit reporters when they want credit.

## Scope

Reports are welcome for Edge Admin, Edge Agent, Nexmaker, deployment assets,
and documentation or configuration that creates a security risk. For VPN
implementation behavior, include the relevant Netmaker or netclient version so
we can determine whether the issue belongs upstream or in Edge Core's
integration.

Please avoid accessing data that is not yours, disrupting services, or using
social engineering while researching a report.