From 1c42c8382a02302c4326e4671101511bbe2dd417 Mon Sep 17 00:00:00 2001
From: Keith <74844722+keith-gardner@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:31:34 -0400
Subject: [PATCH] Add SECURITY.md for vulnerability reporting guidelines

Added a security policy document outlining the process for reporting vulnerabilities, what to include in reports, and the scope of interest for security issues.
---
 SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..54d7aab
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or social media.**
+
+Instead, email us at **[support@branta.pro](mailto:support@branta.pro)**.
+
+### What to include
+
+To help us triage and resolve the issue quickly, please include:
+- A description of the vulnerability and its potential impact
+- Step-by-step instructions to reproduce the issue
+- The affected version(s) of the Branta SDK, your platform, and implementation details
+- Any proof-of-concept code, logs, or screenshots (please redact any sensitive credentials)
+- Whether the issue has been disclosed anywhere else
+
+### What to expect
+
+- We will acknowledge your report as soon as possible and keep you informed as we investigate
+- We will work with you to understand and validate the issue
+- Once a fix is released, we are happy to credit you for the discovery if you would like
+
+We ask that you give us a reasonable amount of time to address the issue before any public disclosure.
+
+## Scope
+
+Reports of particular interest include:
+- Authentication bypass or privilege escalation
+- Exposure of sensitive data or credentials
+- Remote code execution vulnerabilities
+- Payment transaction handling flaws
+- Privacy leaks or data exposure issues
+- Vulnerabilities in Branta infrastructure that users depend on
+
+Issues in third-party dependencies should be reported upstream to the respective projects, though we appreciate a heads-up if Branta is affected.