# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 0.x     | :white_check_mark: |

## Reporting a Vulnerability

If you discover a security vulnerability in php-aegis, please report it responsibly.

### Process

1. **Do not** open a public GitHub issue
2. Report via [GitHub Security Advisories](https://github.com/hyperpolymath/php-aegis/security/advisories/new) (preferred)
3. Or contact the maintainer via [GitHub profile](https://github.com/hyperpolymath)

### Include

- Description of the vulnerability
- Steps to reproduce
- Potential impact assessment
- Suggested fix (if any)

### Timeline

- Acknowledgment within 48 hours
- Status update within 7 days
- Credit in security advisory (unless you prefer anonymity)
- 90-day disclosure window

## Security Design Principles

php-aegis is built with these principles:

- **Defense in Depth**: Multiple layers of validation
- **Fail Secure**: Errors deny access rather than grant it
- **Least Privilege**: Methods do minimum necessary
- **Input Validation**: All input treated as untrusted

## Security Advisories

Published at: https://github.com/hyperpolymath/php-aegis/security/advisories
