# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 0.4.x   | :white_check_mark: |
| 0.3.x   | :white_check_mark: |
| 0.2.x   | :white_check_mark: |
| < 0.2   | :x:                |

Each version will be supported for six months after release or until a new release has been made, whichever is longer.

## Reporting a Vulnerability

We take the security of our document-processor seriously. If you believe you've found a security vulnerability, please follow these steps:

### How to Report

1. **Do NOT disclose the vulnerability publicly** until it has been addressed by our team.
2. Email your findings to [security@christianlouis.de](mailto:security@christianlouis.de). Encrypt your message if it contains sensitive details.
3. Include as much information as possible:
   - Type of vulnerability
   - Full paths of source files related to the vulnerability
   - Step-by-step instructions to reproduce the issue
   - Proof of concept code, if possible
   - Impact of the vulnerability

### What to Expect

- A confirmation email within 48 hours acknowledging your report.
- An assessment and validation of the reported vulnerability within 1 week.
- Regular updates about the progress of addressing the vulnerability.
- Credit for discovering and reporting the vulnerability (if desired).

### Disclosure Policy

- Please allow us reasonable time to resolve the issue before making any public disclosures.
- We aim to address confirmed vulnerabilities within 30-90 days, depending on complexity.
- Once the vulnerability is fixed, we'll publish a security advisory with details and credit.

## Security Best Practices

When using document-processor:
- Keep your installation up-to-date with the latest security patches
- Use strong access controls and authentication mechanisms
- Validate all inputs from untrusted sources
- Follow the principle of least privilege when configuring permissions

## Security Updates

Security updates will be released as part of our regular versioning process. Critical security fixes may be released as out-of-band updates.

## Acknowledgments

We'd like to thank the following individuals for responsibly reporting security issues:

*This list will be updated as contributions are received.*