# Security Policy
## Reporting a Vulnerability
If you discover a security vulnerability in bijli, please report it
responsibly through **GitHub Security Advisories**:
1. Go to the [Security tab](../../security/advisories) of this repository.
2. Click **"Report a vulnerability"**.
3. Fill in the details and submit.
**Do not open a public issue for security vulnerabilities.**
## Response Timeline
| Acknowledgement | Within **48 hours** |
| Initial assessment | Within **5 business days** |
| Fix for critical severity | Within **14 days** |
| Fix for high severity | Within **30 days** |
| Fix for moderate/low severity | Next scheduled release |
## Scope
This policy covers the `bijli` crate and its published API. Vulnerabilities
in dependencies should be reported to the respective upstream projects (and
flagged here if they affect bijli users).
## Disclosure
We follow coordinated disclosure. Once a fix is released, we will publish a
security advisory crediting the reporter (unless anonymity is requested).