We take security seriously. If you discover a security vulnerability in Rayda, please report it responsibly.

Please do NOT create public issues for security vulnerabilities.

Instead, report security issues by:

1. Email: Send details to the project maintainers (contact info in package.json)
2. GitHub Security: Use GitHub's private vulnerability reporting feature
3. Direct Message: Contact maintainers through secure channels

When reporting a security vulnerability, please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Suggested fix (if you have one)
• Your contact information

• Acknowledgment: We'll confirm receipt within 48 hours
• Initial Assessment: We'll provide an initial assessment within 5 business days
• Resolution: We aim to resolve critical issues within 14 days
• Disclosure: We'll coordinate public disclosure after the fix is deployed

Security updates are provided for the latest stable release. Please ensure you're using the most recent version.

For contributors and users:

• Keep dependencies updated
• Use environment variables for sensitive configuration
• Never commit API keys or secrets to the repository
• Enable two-factor authentication on GitHub accounts
• Review code changes carefully before merging

This security policy covers:

• The main Rayda application code
• Build and deployment processes
• Dependencies and third-party integrations
• User data handling practices

We appreciate responsible disclosure and will acknowledge security researchers who help improve Rayda's security (with permission).

Thank you for helping keep Rayda and our community safe!