If you discover a security vulnerability, please:

1. Do NOT open a public issue
2. Email the maintainer directly
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Initial response: Within 48 hours
• Fix timeline: Depends on severity
  • Critical: 24-48 hours
  • High: 1 week
  • Medium: 2 weeks
  • Low: Next release

This policy covers:

• The WSPR HA Bridge integration code
• Docker container configuration
• HACS custom component

Out of scope:

• WSPR.live service
• Home Assistant core
• Third-party dependencies