# Security Policy

<!-- toc -->
- [Reporting a Vulnerability](#reporting-a-vulnerability)
  - [What to Include](#what-to-include)
  - [What to Expect](#what-to-expect)
- [Supported Versions](#supported-versions)
- [Security Best Practices](#security-best-practices)
<!-- /toc -->

If you discover a security vulnerability, please report it privately via [GitHub Security Advisory](https://github.com/XHToken/community/security/advisories/new). Do not open a public issue.

Alternatively, you can email the security team at tokenspark-security@googlegroups.com. Do not open a public issue.

## Reporting a Vulnerability

**Do not** report security vulnerabilities through public GitHub issues.

Instead, please report security vulnerabilities by emailing the project's security team. The team will investigate and respond as soon as possible.

### What to Include

Please include the following information in your report:

* A description of the vulnerability
* Steps to reproduce the issue
* Potential impact of the vulnerability
* Any suggested fixes or mitigations (if available)

### What to Expect

* **Acknowledgment**: We will acknowledge receipt of your report within 48 hours
* **Assessment**: We will assess the vulnerability and determine the severity
* **Resolution**: We will work on a fix and coordinate the disclosure
* **Credit**: We will credit you for the discovery (unless you prefer to remain anonymous)

## Supported Versions

Only the latest release receives security patches. Users are encouraged to upgrade to the latest version to receive security fixes.

## Security Best Practices

* Keep all dependencies up to date
* Enable two-factor authentication on your GitHub account
* Follow the principle of least privilege when granting access
* Review code changes carefully before merging