Update this table when you publish releases.

Please do not report security vulnerabilities through public GitHub issues.

Report them via:

1. GitHub Security Advisory — private vulnerability reporting on the repository
2. Direct contact — @open-templates

• Clear description of the issue
• Impact if exploited
• Steps to reproduce
• Affected versions and environment
• Minimal proof-of-concept if applicable

• Initial response: 48 hours
• Status update: 7 days
• Resolution: 30 days for confirmed issues

When you build on this template:

1. Secrets — Never commit .env, keys, or credentials; use .env.example only.
2. Dependencies — Keep Dependabot enabled and review update PRs.
3. Automation — Restrict who can change .github/workflows/ (CODEOWNERS helps).
4. Errors — Do not expose stack traces or secrets in user-facing output.

This policy applies to code and configuration in this repository once you add application logic. It does not cover third-party services you integrate later.

With your permission, we may credit reporters in security advisories or CHANGELOG.md.

Thank you for helping keep this project and its users safe.

README | INSTRUCTIONS | CHANGELOG | CONTRIBUTING | SECURITY | CODE_OF_CONDUCT