Please do not report security vulnerabilities through public issues.

Instead, report them by email to: hello@lightlib.org

When reporting a vulnerability, please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Affected versions (if known)
• Suggested fix (if any)
• Proof-of-concept code (if possible)

• Initial response: Within 48 hours
• Status update: Within 7 days
• Fix timeline: Depends on severity (typically 30-90 days)
• Public disclosure: After fix is released

We follow coordinated disclosure:

1. You report the issue privately by email
2. We confirm and investigate the vulnerability
3. We develop and test a fix
4. We release the patch
5. We publicly disclose with credit to the reporter (unless anonymity requested)

• Vulnerabilities in lightlib source code
• Security issues in build configuration
• Dependency vulnerabilities (reported to us, we will update)

• Third-party dependency issues (report upstream)
• Issues requiring physical access to a user's system
• Social engineering attacks
• Theoretical vulnerabilities without proof of concept
• Denial of service issues (unless critical)

We appreciate security researchers and will credit reporters in:

• Security advisories (published on GitVerse)
• Release notes
• CHANGELOG.md

Credit can be anonymous if requested.

lightlib is licensed under LGPL-3.0-or-later.

Thank you for helping keep lightlib and its users safe.