Please do NOT report security vulnerabilities through public GitHub issues.

Instead, use GitHub Security Advisories to report vulnerabilities privately.

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Suggested fix (if any)

This policy covers:

• devtronic CLI package (packages/cli/)

This policy does not cover:

• Projects generated by devtronic (user responsibility)
• Third-party dependencies (report upstream)

We follow coordinated disclosure:

1. Reporter submits vulnerability privately
2. We acknowledge and assess
3. We develop and test a fix
4. We release the fix and publish an advisory
5. Reporter receives credit (unless they prefer anonymity)

Thank you for helping keep devtronic and its users safe.