If you discover a security vulnerability in Paracle, please report it responsibly by emailing security@ibiface.com.

Please do NOT open a public GitHub issue for security vulnerabilities.

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Any suggested fixes (optional)

• Initial acknowledgment: Within 48 hours
• Status update: Within 7 days
• Resolution target: Within 30-90 days depending on severity

We regularly scan dependencies for vulnerabilities using:

• bandit - Python security linter
• safety - Dependency vulnerability scanner
• pip-audit - Python package audit

• All code changes require review
• Automated security scanning in CI/CD
• Type hints and Pydantic validation throughout

• Never commit secrets to the repository
• Use environment variables for API keys
• .env files are gitignored

Before submitting code:

1. Run security linters locally:

   bandit -r packages/
   safety check

2. Ensure no secrets are committed:

   detect-secrets scan

3. Follow secure coding practices in CONTRIBUTING.md