# Security Policy

Security is a top priority for the **Astromesh Agent Runtime Platform**.

If you discover a security vulnerability, please report it responsibly.

------------------------------------------------------------------------

# Supported Versions

  Version   Supported
  --------- -----------
  latest    yes

------------------------------------------------------------------------

# Reporting a Vulnerability

Please do **not** open a public GitHub issue for security
vulnerabilities.

Instead send an email to:

security@astromesh.ai

Include:

• Description of the vulnerability\
• Steps to reproduce\
• Potential impact\
• Suggested fix (if available)

------------------------------------------------------------------------

# Responsible Disclosure

We follow a responsible disclosure process:

1.  Security report received
2.  Maintainers investigate the issue
3.  Fix is developed
4.  Security patch released
5.  Public advisory published

------------------------------------------------------------------------

# Security Best Practices

When deploying Astromesh:

• Enable TLS for API endpoints\
• Use secure environment variables for secrets\
• Enable guardrails for input/output validation\
• Restrict network access to runtime infrastructure\
• Monitor logs and telemetry

------------------------------------------------------------------------

# Security Scope

Security concerns may include:

• API vulnerabilities\
• Remote code execution\
• Data exposure\
• Authentication issues\
• Dependency vulnerabilities

------------------------------------------------------------------------

# Acknowledgements

We appreciate responsible disclosure and will credit researchers who
report valid security vulnerabilities.
