mp3rgain 2.1.0

# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 2.x     | :white_check_mark: |
| < 2.0   | :x:                |

## Reporting a Vulnerability

If you discover a security vulnerability in mp3rgain, please report it responsibly.

**Do NOT open a public GitHub issue for security vulnerabilities.**

Instead, please use [GitHub's private vulnerability reporting](https://github.com/M-Igashi/mp3rgain/security/advisories/new) to submit your report.

### What to include

- Description of the vulnerability
- Steps to reproduce
- Affected version(s)
- Potential impact

### Response timeline

- **Acknowledgment**: within 7 days
- **Fix or mitigation**: best effort, typically within 30 days

## Security Measures

This project uses the following automated security tools:

- **Dependabot** — dependency updates and vulnerability alerts
- **CodeQL** — static analysis for Rust and GitHub Actions
- **Secret scanning** — prevents accidental credential commits