The VeritasGraph team and community take security seriously. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

Security updates are provided for the most recent released version of VeritasGraph. We recommend always running the latest release.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, report them privately using one of the following channels:

1. GitHub Security Advisories (preferred): Use the "Report a vulnerability" button in the Security tab of this repository.
2. Direct contact: Reach out to the maintainer, Bibin Prathap, through the contact details on the GitHub profile.

Please include as much of the following information as possible to help us understand and resolve the issue quickly:

• The type of issue (e.g., injection, authentication bypass, data exposure).
• Full paths of source file(s) related to the issue.
• The location of the affected source code (tag/branch/commit or direct URL).
• Any special configuration required to reproduce the issue.
• Step-by-step instructions to reproduce the issue.
• Proof-of-concept or exploit code (if possible).
• The impact of the issue, including how an attacker might exploit it.

1. You report the vulnerability privately through one of the channels above.
2. We acknowledge receipt within 5 business days.
3. We investigate and work on a fix, keeping you informed of progress.
4. Once a fix is ready, we coordinate a disclosure timeline with you.
5. We release the fix and publicly credit you (unless you prefer to remain anonymous).

This policy applies to the VeritasGraph codebase in this repository. Issues in third-party dependencies should be reported to the respective maintainers, though we appreciate a heads-up so we can update affected dependencies.

Thank you for helping keep VeritasGraph and its users safe.