# Security Policy

## Supported versions
Security fixes are applied to the latest release branch and `main`.

## Reporting a vulnerability
Do not open public issues for security vulnerabilities.

Until a dedicated private inbox is configured, report privately to repository
maintainers and include:
- Impact summary
- Reproduction steps
- Affected versions or commit hash
- Suggested mitigation (if available)

## Secret handling guidance
- Never commit real passwords, private keys, tokens, or host fingerprints.
- Use `--store-password` and key passphrase flags only in local trusted setups.
- Treat exported encrypted bundles (`*.enc`) as sensitive artifacts.