SECURITY.md

Rama develop · réplica de lectura del repositorio original.

# Security Policy

## Supported Versions

| Version | Supported |
| ------- | --------- |
| 3.x     | ✔️  |
| < 3.0   | ❌ |

## Reporting a Vulnerability

Please **do not** report security vulnerabilities through public GitHub issues or community forums.

### Reporting Channels
* **Email:** Send encrypted email to `scm-team@cloudogu.com`.  
  *PGP Key:* [`5FCB E8AA B565 7AB5 93EB  91EB 68E5 79F3 795D F79D`](./security-pubkey.asc)
* **GitHub Advisory:** Submit privately via the "Security" tab -> "Report a vulnerability".

### What to Include
* Description of the issue and potential impact.
* Affected version(s) and specific plugins/components.
* Detailed steps to reproduce or a Proof of Concept (PoC).

## Response Expectations
* **Initial Response:** Within 48 hours.
* **Triage Update:** Within 5 business days.

## Safe Harbor
Activities conducted in good faith and in compliance with this policy are considered authorized.
We will not pursue legal action against researchers operating under these guidelines.