# Courier Protocol Security Policy

## Reporting a Security Vulnerability

We take the security of Courier Protocol seriously. If you believe you have found a security vulnerability, please report it to us immediately.

**How to Report:**
- Email: security@getcourier.dev
- PGP encrypted: https://getcourier.dev/.well-known/pgp-key.txt

**What to Include:**
- Description of the vulnerability
- Steps to reproduce
- Affected versions
- Any proof-of-concept code
- Your contact information for follow-up

## Our Commitment

- We will acknowledge receipt of your report within 48 hours
- We will provide an estimated timeline for a fix
- We will keep you informed of progress
- We will credit you for the discovery (if desired)

## Scope

- Courier Protocol core software
- Courier API services
- Courier web applications

## Out of Scope

- Social engineering attacks
- Physical security attacks
- Denial of service attacks
- Issues in third-party dependencies already reported upstream

## Disclosure Policy

We request that security researchers:
1. Allow us reasonable time to fix the issue before public disclosure
2. Do not access or modify user data without permission
3. Do not perform attacks that could affect system reliability

## Contact

security@getcourier.dev