Security updates are provided for the latest version of SecureVault.

If you discover a security vulnerability in SecureVault, please report it responsibly.

Do not publicly disclose the vulnerability in a GitHub Issue, Discussion, pull request, or other public channel before it has been reviewed.

Please include as much of the following information as possible:

• A clear description of the vulnerability.
• Steps to reproduce the issue.
• The affected version of SecureVault.
• The affected platform, such as Windows or Android.
• The potential security impact.
• Screenshots or proof of concept, if safe to provide.
• Any suggested mitigation or fix.

For security vulnerabilities, contact the project maintainer privately through GitHub rather than creating a public issue.

If private reporting options become available for this repository, use GitHub's private vulnerability reporting feature.

After receiving a vulnerability report, the project maintainer will:

1. Review and verify the reported issue.
2. Assess the potential security impact.
3. Investigate and develop a fix where appropriate.
4. Release a security update when necessary.
5. Coordinate disclosure after the issue has been addressed.

Response times may vary depending on the complexity and severity of the vulnerability.

Please do not include the following in public issues or reports:

• Real passwords.
• Master passwords.
• Private encryption keys.
• Firebase administrative credentials.
• API secrets.
• Personal vault data.
• Private user information.

Use test data when demonstrating a security vulnerability whenever possible.

This security policy applies to the SecureVault source code and officially released Windows and Android versions of the application.

Third-party dependencies and external services may have their own security policies and should also be reported to their respective maintainers.

We appreciate responsible security research and reports that help improve SecureVault.

Please allow reasonable time for a vulnerability to be investigated and addressed before publicly disclosing details.

Thank you for helping keep SecureVault and its users more secure.