# Security Policy

## Reporting a vulnerability

If you believe you have found a security issue in PureYAML, please report it
privately. Do not open a public issue for security problems.

Email **mihaelamj@gmail.com** with:

- A description of the issue and its impact.
- Steps to reproduce, or a proof of concept.
- The affected version or commit.

You can expect an acknowledgement within a few days. Once the issue is confirmed,
a fix will be prepared and a release cut, after which the issue can be disclosed
publicly with credit to the reporter if desired.

## Supported versions

PureYAML is pre-1.0 and under active development. Security fixes are applied to
the `main` branch. Until a stable release exists, only the latest `main` is
supported.

## Scope

PureYAML parses, validates, and emits YAML. Reports about how the library
handles untrusted input are in scope, for example:

- Malformed or adversarial input that causes a crash, an unbounded loop, stack
  overflow, or excessive memory or CPU use.
- Parser or emitter behavior that misrepresents input in a way a consumer could
  rely on for a security decision (for example, a value that round-trips to a
  different meaning).
- Incorrect rejection or acceptance of input by the validation layer that a
  consumer treats as a trust boundary.