We take security seriously and value the security community's help in identifying and reporting vulnerabilities.

Please report security vulnerabilities privately:

• Email: security@milany-linux.org
• PGP Key: Available on request for encrypted communication
• Response Time: We aim to respond within 48 hours

Please provide as much information as possible:

• Vulnerability Type: (e.g., SQL injection, XSS, privilege escalation)
• Impact: What could an attacker do?
• Steps to Reproduce: Detailed, step-by-step instructions
• Environment: OS version, configuration, affected components
• Proof of Concept: Code snippets or screenshots if applicable

We commit to:

• No Legal Action: We won't pursue legal action against security researchers
• Credit: Public acknowledgment of your contribution (with your permission)
• Coordination: Work with you to understand and fix the issue
• Timeline: Regular updates on our progress

This policy applies to:

• ✅ milany source code and official builds
• ✅ milany tools and utilities
• ✅ milany infrastructure (websites, APIs)
• ✅ Documentation and configuration files

The following are explicitly out of scope:

• ❌ Third-party dependencies (report to respective projects)
• ❌ Physical attacks on infrastructure
• ❌ Social engineering or phishing
• ❌ Denial of service attacks
• ❌ Theoretical vulnerabilities without proof of concept

We're particularly interested in:

• Remote Code Execution
• Privilege Escalation
• Information Disclosure
• Authentication Bypass
• Cryptographic Weaknesses
• Network Security Issues
• Configuration Security
• Data Protection Failures

We recognize security researchers through:

• Hall of Fame: Public acknowledgment (with permission)
• Swag: milanY merchandise for significant findings
• Bounties: For critical vulnerabilities (when funding available)
• References: Professional references upon request

We classify vulnerabilities as:

milany follows these security principles:

• Privacy by Design: No telemetry, no data collection
• Secure Defaults: Encrypted communications, minimal attack surface
• Regular Audits: Code reviews and security testing
• Open Source: Transparent security through community review
• Least Privilege: Minimal permissions required

• Security Team: security@milany-linux.org
• PGP Fingerprint: Available on request
• Response SLA: 48 hours initial response
• Language: English (translations available for major languages)

This policy is governed by the laws of the jurisdiction where milanY is developed. We reserve the right to modify this policy at any time.

Thank you for helping keep milanY secure! 🛡️