[PROJECT_NAME] Security and Vulnerability Disclosure Policy

Effective date: [DATE]

How we protect your data

• All traffic is encrypted with TLS; data is stored with encryption at rest at [HOSTING_PROVIDER].
• Access to production systems is limited to people who need it, with strong authentication.
• Passwords are never stored in plain text; sign-in codes and keys are stored hashed.
• Software is updated regularly and dependencies are monitored for known vulnerabilities.
• Backups are encrypted and tested.
• If a personal data breach puts your rights at risk, we tell you and the authorities as the law requires.

Reporting a vulnerability

Email [SUPPORT_EMAIL] with "Security" in the subject. Include what you found, where, and the steps to reproduce it.

We promise to: confirm receipt within 3 business days, keep you updated, fix confirmed issues as quickly as we can, and credit you if you want.

Please: give us reasonable time to fix the issue before telling anyone; don't access, change or delete data that isn't yours (use your own test accounts); don't disrupt the service (no denial of service, no spam, no social engineering of our staff).

If you follow these rules in good faith, we will not take legal action against you for your research.

[COMPANY_NAME], [COMPANY_ADDRESS].