# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| Latest on `master` | ✅ |

## Reporting a Vulnerability

If you discover a security issue, **please do not open a public GitHub issue**.

Instead, contact the maintainer privately:

- **GitHub:** [@ahmadreza-log](https://github.com/ahmadreza-log)

Include as much detail as possible:

- Type of vulnerability (e.g. SQL injection, XSS, auth bypass)
- Affected URL or endpoint
- Steps to reproduce
- Impact assessment

You can expect an initial response within **7 days**. We will work with you to understand and address the issue before any public disclosure.

## Security Practices in This Project

- Passwords hashed with `password_hash()` (bcrypt)
- CSRF tokens on state-changing requests
- Login rate limiting (configurable in `config/app.php`)
- PDO prepared statements
- Upload MIME validation and size limits
- `.htaccess` blocks direct access to `app/` and `config/`
- PHP execution disabled in `storage/uploads/`

## Deployment Checklist

- [ ] Use HTTPS in production
- [ ] Set strong admin and database passwords
- [ ] Restrict file permissions on `config/` and `storage/`
- [ ] Remove or protect `/install` after setup (installer blocked once `installed.lock` exists)
- [ ] Keep PHP and MySQL updated
