# Security Policy

## Supported Versions

| Version | Supported |
|---|---|
| 0.x (dev) | ✅ Active development — reports welcome |

## Reporting a Vulnerability

This is a small open-source project. If you find a security issue:

1. **Do not** open a public issue.
2. Email the maintainer directly or reach out via
   [GitHub Security Advisories](https://github.com/klimadev/vendas_oficina/security/advisories).

You should receive a response within 72 hours. We'll work with you to
understand and address the issue.

## Scope

- Evolution API credentials should be treated as secrets
- DeepSeek API keys should be kept out of version control
- The webhook endpoint (`/webhook`) validates incoming data but does not
  authenticate the caller; use network-level controls (firewall, VPN, TLS
  client certs) to restrict access to your Evolution API instance
- `.env` files are gitignored — never commit them