Do not open a GitHub issue to report security vulnerabilities.

If you believe you have found a security vulnerability, you can report it privately via either of these channels:

• GitHub: use Report a vulnerability (preferred)
• Email: amaanulhaq.s@outlook.com

Include the following in your report:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Proof of concept (if available)

You will receive an acknowledgment within 48 hours. Once confirmed, critical vulnerabilities will be fixed within 90 days and all others within 180 days. You will be notified when a fix is released, and credited for the disclosure if desired.

Do not disclose the vulnerability publicly until a fix has been released.

All commits and tags from the maintainer are GPG-signed. You can verify them using the following key:

Fetch and verify:

gpg --keyserver keyserver.ubuntu.com --recv-keys FC47DEE803DB612A
gpg --verify <signed-file-or-tag>

• All changes are reviewed before merging
• Dependencies are regularly audited for known vulnerabilities
• All commits must be GPG-signed (git commit -S)
• No secrets, API keys, or credentials are committed to the repository
• Security-relevant functionality is covered by tests

Security fixes are released as versioned updates. Users should:

1. Keep dependencies up to date
2. Monitor GitHub releases for security patches
3. Review the changelog for security-related changes

When deploying this project:

• Follow the principle of least privilege for IAM policies
• Use environment variables for all sensitive configuration
• Never hardcode secrets or credentials
• Rotate authentication tokens periodically
• Run behind a reverse proxy with TLS in production

Security feature requests and improvement suggestions are welcome as GitHub issues.

For security-related questions, contact amaanulhaq.s@outlook.com.