SECURITY.md

Rama main · réplica de lectura del repositorio original.

# Security Policy

## Reporting a Vulnerability

If you believe you have found a security vulnerability in Lumina Finance, please report it by emailing:

**[security@luminafinance.co](mailto:security@luminafinance.co)**

Please do not open a public GitHub issue for security vulnerabilities.

When reporting a vulnerability, please include as much detail as possible, including:

- A description of the issue
- Steps to reproduce the issue
- The potential impact
- Any relevant screenshots, logs, proof-of-concept code, or affected files
- Your contact information in case we need to follow up

We will review reports as soon as reasonably possible and may contact you for additional information.

## Responsible Disclosure

We ask that you give us a reasonable amount of time to investigate and address the issue before publicly disclosing it.

Please do not:

- Access, modify, delete, or exfiltrate data that does not belong to you
- Disrupt or degrade Lumina Finance services or infrastructure
- Use automated scanning in a way that could cause harm or service disruption
- Social engineer, phish, or physically attack Lumina Finance users, contributors, maintainers, or service providers
- Publicly disclose the vulnerability before we have had a chance to review and address it

## Scope

This policy applies to security vulnerabilities in the Lumina Finance codebase and related project infrastructure controlled by Lumina Finance.

For self-hosted deployments, users are responsible for securing their own servers, databases, networks, credentials, backups, environment variables, and third-party integrations.

Issues caused by misconfigured self-hosted environments, exposed services, weak credentials, outdated dependencies, or insecure infrastructure outside of the Lumina Finance codebase may be outside the scope of this policy.

## Supported Versions

Lumina Finance is currently early-stage software. Security fixes will generally be applied to the latest available version of the project.

Users are encouraged to keep their deployments up to date and regularly review release notes for security-related updates.