From f1c00f40774fc1ca95ecbc9017df8d7f1b3e0f7b Mon Sep 17 00:00:00 2001
From: Sebastian Legarraga <64795732+slegarraga@users.noreply.github.com>
Date: Thu, 6 Aug 2026 17:10:56 -0400
Subject: [PATCH] docs: add security policy

Signed-off-by: Sebastian Legarraga <64795732+slegarraga@users.noreply.github.com>
---
 README.md   |  4 +++-
 SECURITY.md | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 SECURITY.md

diff --git a/README.md b/README.md
index 0517a71..47fc193 100644
--- a/README.md
+++ b/README.md
@@ -719,4 +719,6 @@ Weval uses [Plausible Analytics](https://plausible.io) for privacy-first, cookie
 
 ## Bug Reports & Feedback
 
-Found a bug? Please [open an issue](https://github.com/weval-org/app/issues/new/choose) using our bug report template. See [CONTRIBUTING.md](CONTRIBUTING.md) for details on what to include.
\ No newline at end of file
+Found a bug? Please [open an issue](https://github.com/weval-org/app/issues/new/choose) using our bug report template. See [CONTRIBUTING.md](CONTRIBUTING.md) for details on what to include.
+
+Found a security issue? Report it privately following [SECURITY.md](SECURITY.md).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..1137a32
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,38 @@
+# Security
+
+Weval handles API keys, session secrets, user-supplied blueprints, and calls
+to external model providers. If you believe you have found a security
+vulnerability, please report it privately instead of opening a public issue.
+
+## Reporting
+
+Email `nnojibe@gmail.com` with the subject `[Weval security]`, or use GitHub
+Private Vulnerability Reporting on this repository when it is enabled.
+
+Please include:
+
+- A description of the issue and its impact
+- Steps to reproduce, including the exact environment when possible
+- Any relevant versions or commit SHAs
+
+Do not include live secrets, API keys, session tokens, or personal data in the
+report.
+
+## Scope
+
+- Application authentication and session handling
+- Secret and key handling
+- Blueprint execution and user-supplied input
+- Storage and cloud provider configuration
+- Dependencies with known vulnerabilities
+
+## Response expectations
+
+- Acknowledgment within 3 business days
+- Triage and impact assessment within 7 business days
+- Regular status updates until the issue is resolved or intentionally accepted
+
+## Supported versions
+
+Security fixes are targeted at the current `main` branch and the latest
+release. Older releases are not guaranteed to receive backports.