25 lines (16 loc) · 999 Bytes

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

Do NOT open a public issue.
Email heznpc@gmail.com or use GitHub Security Advisories.
Include steps to reproduce, impact assessment, and suggested fix if possible.

We will respond within 48 hours and work with you to resolve the issue.

Security Features

This template includes automated security checks in CI:

Dependency audit — npm audit on every push (HIGH/CRITICAL threshold)
Secret leak detection — gitleaks scans every commit
Dependency updates — Dependabot monitors for vulnerable dependencies

Best Practices

Never commit .env files or secrets — they are gitignored by default
Use GitHub Secrets for deployment credentials
Keep dependencies up to date by merging Dependabot PRs