This project is under active development. Security updates are prioritized for the current main branch and any actively maintained release line.

Please do not report security vulnerabilities through public issues or pull requests.

If you believe you have found a security issue, report it privately to the maintainers through the repository owner contact channels or the project's private security reporting route. Please include:

• a clear description of the vulnerability
• affected components or endpoints
• steps to reproduce the issue
• potential impact
• any suggested fix or mitigation

We will make our best effort to:

• acknowledge valid reports promptly
• assess the severity and impact
• provide updates as the investigation progresses
• release a fix or mitigation as quickly as possible when needed

We ask that reporters work with us to keep the issue private until a fix is available. Please do not disclose the vulnerability publicly before a coordinated resolution has been completed.

This policy applies to security issues in the project codebase, configuration, deployment workflows, and project-maintained services related to SignPakCommons.