We take the security of this project seriously. If you discover a security vulnerability, please report it responsibly.

For security vulnerabilities, please DO NOT open a public issue.

Instead, please report security vulnerabilities through one of the following methods:

1. Private Vulnerability Reporting (Recommended)

   • Go to the Security Advisories page
   • Click "Report a vulnerability"
   • Provide detailed information about the vulnerability

2. Email

   • Send details to: mia.koring@amethystsoft.de
   • Include "SECURITY" in the subject line

Please include the following information in your report:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested fix (if you have one)

• We will acknowledge receipt of your report within 48 hours
• We will provide a detailed response within 7 days
• We will keep you informed of our progress
• We will credit you in the fix announcement (unless you prefer to remain anonymous)

This repository has the following security features enabled:

• ✅ Branch Protection
• ✅ Private Vulnerability Reporting
• ✅ Secret Scanning with Push Protection
• ✅ Dependabot Security Updates
• ✅ Code Scanning (CodeQL) including Actions workflow security

When contributing to this project:

• Never commit secrets (API keys, passwords, tokens)
• Don’t use outdated dependencies when adding new ones
• Follow secure coding practices
• Review Dependabot alerts and PRs promptly

If you have questions about this security policy, please open a discussion or contact the maintainers.

Vein currently has no known or reported vulnerabilities. If you discover a security vulnerability, please report it privately via one of the methods stated in How to Report.

Thank you for helping keep this project secure! 🔒