Currently supported versions for security updates:

We take the security of VAGINA seriously. If you believe you have found a security vulnerability, please report it to us as described below.

• Open a public GitHub issue for security vulnerabilities
• Discuss the vulnerability in public forums until it has been addressed

1. Email: Send details to [maintainer email] (to be added)
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Fix Timeline: Depending on severity (critical bugs within 7-14 days)
• Credit: Security researchers who responsibly disclose vulnerabilities will be credited

1. API Keys: Never commit Azure OpenAI API keys to version control
2. Storage: API keys are stored securely in device-local storage
3. Updates: Keep the app updated to receive security patches
4. Permissions: Only grant necessary permissions (microphone for calls)

1. Dependencies: Run flutter pub outdated regularly
2. Code Review: All code changes require review
3. Testing: Write security-aware tests
4. Secrets: Never hardcode secrets, API keys, or credentials
5. Input Validation: Validate all user input
6. Third-party Libraries: Keep dependencies up to date

• API keys: Stored in platform secure storage
• Session history: Stored locally in JSON files
• No data sent to third parties except Azure OpenAI API

• WebSocket connection to Azure OpenAI uses TLS
• No telemetry or analytics collection
• All audio processing happens client-side

• Microphone: Required for voice calls
• Storage: Required for saving sessions/settings
• Internet: Required for API communication

When we receive a security bug report, we will:

1. Confirm the problem and determine affected versions
2. Audit code to find similar problems
3. Prepare fixes for all supported releases
4. Release security updates as soon as possible

Security updates will be released as:

• Patch versions (e.g., 1.0.1) for minor fixes
• Minor versions (e.g., 1.1.0) for larger security enhancements
• Documented in CHANGELOG.md with [SECURITY] tag

For general security questions that don't require private disclosure:

• Open a GitHub Discussion
• Tag with security label

Thank you for helping keep VAGINA secure!