SECURITY.md

Rama main · réplica de lectura del repositorio original.

# Security Policy

## Reporting a vulnerability

Please report security vulnerabilities **privately** — do not open a public issue.

Use GitHub's private reporting: go to the repository's
**Security → Advisories → Report a vulnerability** page
([open the form](https://github.com/gocov/gocov/security/advisories/new)).
This creates a private advisory visible only to you and the maintainers.

Please include:

- a description of the issue and its impact,
- steps to reproduce (a proof of concept if possible),
- affected version(s) and platform.

## What to expect

- We aim to acknowledge your report within **3 business days**.
- We'll keep you updated as we investigate and work on a fix.
- Once a fix is released, we're happy to credit you in the advisory
  (let us know if you'd prefer to stay anonymous).

Please give us a reasonable window to release a fix before any public
disclosure.

## Supported versions

Security fixes are applied to the **latest released version**. We recommend
always running the most recent release of the CLI and server.

## Scope

This policy covers the `gocov` CLI, the `gocov-server`, and the hosted
service at **app.gocov.dev**. Reports about third-party dependencies are
welcome, but please report them upstream as well where appropriate.