# Security Policy

## Supported Versions

This project currently supports the latest active branch in this repository.

## Reporting a Vulnerability

If you discover a security issue, please do not open a public issue with exploit details.

Preferred process:

1. Share a private report with:
   - A clear description of the issue
   - Reproduction steps
   - Impact assessment
   - Suggested fix (if available)
2. Allow time for triage and remediation before public disclosure.

## Scope Notes

- Supabase anon keys are client-side by design and are not secret credentials.
- Real protection depends on strict RLS policies, RPC authorization, and server-side validation.
- Local config files with runtime values should stay out of version control.

## Recommended Hardening

- Keep Supabase keys in local/CI `dart-define` configuration only.
- Rotate keys when moving between environments or if misuse is suspected.
- Audit RLS policies after every schema/function change.
- Sanitize user-facing error messages (avoid leaking backend internals).