If you believe you've found a security vulnerability in LoreFountain, please report it privately rather than opening a public issue — email CyberSupport@allstonetech.com with:

• A description of the vulnerability and its potential impact
• Steps to reproduce it (a minimal example, if possible)
• The LoreFountain version and VS Code version you tested against

We'll acknowledge your report and follow up as we investigate. Please give us a reasonable amount of time to address the issue before any public disclosure.

LoreFountain is pre-1.0 (0.x.y); only the latest published release is supported with security fixes. See CHANGELOG.md for release history.

This policy covers the LoreFountain VS Code extension itself (this repo). It does not cover third-party dependencies — please report those upstream — though we're glad to hear about a vulnerable dependency here too so we can update it.