Security policy

Report vulnerabilities privately. Do not open a public issue, discussion or pull request for one, and never paste credentials, tokens or exploit details publicly.

1. If Security → Report a vulnerability is shown on the repository, use it.
2. Otherwise e-mail mohsen.seyedkazemi@gmail.com with “ReachWeaver security” in the subject. Describe where a secret leaked instead of attaching it, and revoke any real credential at its provider first.
3. If neither works, open a public issue that says only “requesting a private security contact”, with no details.

Reports are handled on a best-effort basis; there is no service level. ReachWeaver is experimental software provided “as is” (see DISCLAIMER.md). Supported version: the latest main.

Scope, threat model and operator checklist: docs/SECURITY.md.