# Security Policy

## Supported Versions

| Version | Supported          |
|---------|--------------------|
| 1.0.x   | :white_check_mark: |

## Reporting a Vulnerability

If you discover a security vulnerability in this package, please report it responsibly.

**Do not open a public GitHub issue for security vulnerabilities.**

Instead, please email **dimitris@inodra.com** with:

- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

You will receive an acknowledgment within 48 hours. We will work with you to understand and address the issue before any public disclosure.

## Scope

This package performs BCS serialization and deserialization. Security-relevant areas include:

- Integer overflow/underflow in encoding and decoding
- Memory safety during ULEB128 parsing
- Input validation for all BCS types
- Correct handling of malformed or adversarial input bytes