Security policy

Hosted Kads is preparing for early access. Documentation describes the implementation and its connection requirements.

# Security policy

## Supported versions

Security fixes are applied to the current `main` branch and the latest tagged release. Older releases may require upgrading.

## Reporting a vulnerability

Please use GitHub's private vulnerability reporting for this repository. If that option is unavailable, email `security@kads.ai` with the subject `Kads security report`.

Include the affected version, impact, reproduction steps, and any suggested mitigation. Do not include live Meta tokens, app secrets, Supabase service keys, or customer data. Use synthetic evidence and offer to share sensitive details through an agreed secure channel.

We aim to acknowledge a report within three business days, provide an initial assessment within seven business days, and coordinate disclosure after a fix is available. We will credit reporters who want attribution.

Never test against another person's workspace, ad account, or hosted data. Testing must stay within accounts and infrastructure you own or have explicit permission to assess.