# Security Policy

## Reporting a vulnerability

Please do not open a public issue or pull request for a security problem.

Report it privately instead, in either of these ways:

- On GitHub: open the **Security** tab of this repository and choose **Report a vulnerability**.
- By email: write to **sg85207@gmail.com** with the subject `[ledger-sync security]`.

Include what you found, how to reproduce it, and the impact you expect. You should get a first
response within 7 days, and we will agree on a fix and a disclosure timeline together.

## Supported versions

Security fixes go to the latest version on the default branch. Older versions are not
patched.

## What counts

- A way to run code, leak data or bypass a protection through this repository's code or
  configuration.
- Secrets committed to the repository (API keys, tokens, private keys). Report these privately
  so they can be rotated before anything is made public.