# Security Policy

## Reporting a vulnerability

Email security@hanzo.ai with details. We respond within 48 hours; critical
issues receive same-day acknowledgment.

Report to us, not to the upstream this fork came from. They cannot fix what we
ship, and routing a live vulnerability in our deployment to a third party tells
someone else about it before it reaches the people who can close it.

## Scope

This policy covers the code in this repository. For the broader Hanzo platform
threat model, see [hanzoai/hips](https://github.com/hanzoai/hips).