# Security Policy

## Supported versions

Security fixes are applied to the latest published version.

## Reporting a vulnerability

Please do not open a public issue for an undisclosed vulnerability. Use the
repository's private
[GitHub security advisory form](https://github.com/CodyKoInABox/codys-linecounter/security/advisories/new)
with:

- the affected version and operating system
- a minimal reproduction
- the expected impact
- any suggested mitigation

You should receive an acknowledgment within seven days. A fix and disclosure
timeline will be coordinated after the report is confirmed.

## Scanner safety defaults

Cody does not execute scanned files. It does not follow symbolic links unless
explicitly requested, limits the number of concurrent reads, caps file sizes,
detects binary input, and bounds reads even when a file changes during a scan.