# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly.

**Do not open a public GitHub Issue for security vulnerabilities.**

Instead, email: security@kof22.com

Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

You should receive a response within 72 hours.

## Supported Versions

| Version | Supported |
|---------|-----------|
| 0.x.x   | Current development, best-effort |

## Scope

This policy applies to the Concilium application, its backend APIs, frontend, and any agent execution infrastructure. Third-party dependencies are tracked via SBOM and vulnerability scanning in CI.