# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability, please report it privately:

1. **GitHub Security Advisories (preferred):** [Report a vulnerability](https://github.com/elie222/inbox-zero/security/advisories/new)
2. **Email:** [security@getinboxzero.com](mailto:security@getinboxzero.com)

Please do **not** open a public GitHub issue for security vulnerabilities.

## What to Include

- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Any suggested remediation (optional)

## What to Expect

- Acknowledgement of your report within 3 business days
- Initial assessment within 7 days
- Coordinated disclosure timeline based on severity

## Scope

This policy covers the Inbox Zero application at getinboxzero.com and code in this repository.

## Recognition

We're grateful to researchers who help keep Inbox Zero and our users safe. With your permission, we're happy to credit you in our acknowledgments after the issue is resolved.