If you discover a security vulnerability in Simple Builders, we appreciate your help in disclosing it to us in a responsible manner.

Please do not report security vulnerabilities through public GitHub issues. Doing so discloses an unpatched issue to attackers before a fix is available.

Instead, use GitHub's private vulnerability reporting:

1. Open the repository's Security tab.
2. Click Report a vulnerability to file a private GitHub Security Advisory visible only to you and the maintainers.

Maintainers: enable Private vulnerability reporting under Settings → Code security so the button above is available to reporters.

When reporting a vulnerability, please include:

• A description of the vulnerability
• Steps to reproduce the issue
• Any mitigation or workaround if known
• Your name/handle for recognition (unless you wish to remain anonymous)

• We will confirm the vulnerability and determine its impact
• We will keep you informed of the progress towards resolving the issue
• We will credit you for your discovery (unless you prefer to remain anonymous)

Security updates will be released as patch versions (e.g., 0.1.1) for the latest minor version. We recommend always using the latest version of the library.

We keep dependencies patched and rely on GitHub's native supply-chain tooling rather than a stand-alone scanner:

• Dependabot (.github/dependabot.yml) opens automated update PRs and, with Dependabot alerts enabled, continuously flags known-vulnerable dependencies against the GitHub Advisory Database.
• Dependency Review (.github/workflows/dependency-review.yml) runs on every pull request and fails it if it introduces a dependency with a High (or greater) severity vulnerability or a disallowed license.

Maintainers: ensure Dependency graph, Dependabot alerts, and Dependabot security updates are enabled under Settings → Code security.

When using Simple Builders, we recommend:

1. Always use the latest version
2. Review the code before using in production
3. Follow the principle of least privilege
4. Validate all inputs, especially when using builder patterns with untrusted data

While Simple Builders provides utility for creating builders, please be aware that:

• Builders may be used to construct objects with sensitive data
• Always validate inputs before using them in your application
• Be cautious when serializing/deserializing builder-created objects

By contributing to this project, you agree that your contributions will be licensed under its MIT License.