We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Email the maintainer directly with details about the vulnerability
3. Include the following information:
   • Type of vulnerability
   • Full path of the affected source file(s)
   • Location of the affected code (tag/branch/commit or direct URL)
   • Step-by-step instructions to reproduce the issue
   • Proof-of-concept or exploit code (if possible)
   • Impact of the issue

• Acknowledgment of your report within 48 hours
• Regular updates on the progress (at least every 7 days)
• Credit for discovering the vulnerability (unless you prefer to remain anonymous)

1. Always use the latest version
2. Do not expose Vex directly to the public internet without proper authentication
3. Use TLS/SSL when deploying in production
4. Regularly update your dependencies

When we receive a security bug report, we will:

1. Confirm the problem and determine affected versions
2. Audit code to find any similar problems
3. Prepare fixes for all supported versions
4. Release new versions as soon as possible