# Security Policy

## Supported Scope

This repository contains example projects and reference implementations.
Security reports are welcome for:

- Credential/token exposure in code or docs
- Unsafe defaults in example configurations
- Dependency vulnerabilities in maintained example projects
- Sensitive data leakage in logs or sample files

## Reporting a Vulnerability

Please do not open public issues for security vulnerabilities.

Report privately with:

1. A clear summary of the issue
2. Steps to reproduce
3. Affected file paths and example folders
4. Potential impact
5. Suggested mitigation (if available)

If possible, report through private maintainer channels for the Fetch.ai team.

## Disclosure Process

- We review and validate reports
- We prepare a fix and documentation update
- We publish coordinated disclosure details after remediation

## Security Best Practices for Contributors

- Never commit real secrets, API keys, or private keys
- Use `.env.example` for placeholder values
- Keep dependencies updated
- Avoid copying sensitive logs into public issues/PRs