# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in KiloCenter, please report it responsibly. **Do not open a public GitHub issue.**

Email **info@kiloiot.de** and put `KiloCenter Community Edition` in the subject line. The report
concerns **CHIRP USA LLC**, which publishes this software and operates the Kilo/Fullchirp platform.

Please include:

- Description of the vulnerability
- Steps to reproduce
- Affected versions
- Potential impact assessment
- Any suggested remediation (optional)

Do not include credentials, private keys, customer data, or other sensitive production data in your
first message. If sensitive evidence is needed, we will arrange a restricted channel for it.

## Scope

This policy covers the KiloCenter Community Edition codebase at
[github.com/Kiloiot/kilo-service-center](https://github.com/Kiloiot/kilo-service-center).

For an enterprise edition or Kilo Cloud, use the same address and name the affected product and
environment in the subject line.

## What this policy does not promise

This file does not set an acknowledgement time, a triage time, a remediation time, a supported-version
period, or a disclosure credit. Those commitments are published only once they have been approved, and
they are absent here because they are not yet in place.