Security Policy

Reporting a Vulnerability

If you discover a security vulnerability, please report it through GitHub Security Advisories:

Report a vulnerability

Please do NOT open a public GitHub issue for security vulnerabilities.

What to Include

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

Response Timeline

• Initial response: within 48 hours
• Status update: within 7 days
• Fix timeline: depends on severity

Supported Versions

Version	Supported
0.1.x	Yes

Security Best Practices

When using Proofloop:

• Never commit API keys or secrets
• Use --auto-approve only in trusted environments
• Review generated code before deploying to production