# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 1.0.x   | :white_check_mark: |
| 0.x     | :x:                |

## Reporting a Vulnerability

If you discover a security vulnerability in `dsh-super-subscriptions`, please **DO NOT** open a public issue or paste credentials into an issue, discussion, log, or pull request.

After the public repository is created, use GitHub's **Private vulnerability reporting** entry under the repository's Security tab when it is available. If that feature is not enabled, contact the maintainer privately through the GitHub profile. Include:
1. Description of the vulnerability.
2. Steps to reproduce the issue.
3. Potential impact.
4. A sanitized environment and plugin version.

We will review and respond as quickly as possible.

## Credential & Token Hygiene

- All authentication tokens and refresh tokens are stored exclusively on the user's local machine (`~/.dsh/plugins/super-subscriptions/`).
- Network requests for OAuth authorization use PKCE (RFC 7636) and provider HTTPS endpoints, with loopback callbacks where applicable.
- Do not attach token stores, browser exports, screenshots containing account data, or unredacted logs to a report.