# Security Policy

## Reporting a vulnerability

If you discover a security vulnerability, please **do not** open a public issue.
Instead, email **security@youricp.com** with a description of the issue and steps
to reproduce. We aim to acknowledge reports within 3 business days.

## Scope

- Never share real API tokens, credentials, or customer data in reports.
- This repository is a reference client; server-side/API issues should also be
  reported to the address above.

Thank you for helping keep YourICP and its users safe.