From 7334047744143e7a9139c6135a69cfbf597977af Mon Sep 17 00:00:00 2001
From: Exocet92 <79667065+Jimmy7892@users.noreply.github.com>
Date: Tue, 25 Aug 2026 19:59:34 +0200
Subject: [PATCH] docs: add security policy

---
 SECURITY.md | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d56cfd0
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are issued for the latest published release of `manifoldbt` on
+PyPI. Older versions are not patched; upgrade with `pip install -U manifoldbt`.
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.**
+
+Use GitHub's private reporting: go to the **Security** tab of this repository
+and click **Report a vulnerability**. That opens a private advisory visible only
+to you and the maintainers.
+
+If you cannot use that, email **contact@manifoldbt.com** with `SECURITY` in the
+subject line.
+
+Please include:
+
+- the version of `manifoldbt` and of Python, and the operating system
+- what an attacker can do with the issue
+- a minimal reproduction, ideally a script that runs against public data
+
+## What to expect
+
+- Acknowledgement within 5 business days.
+- An assessment, with a fix timeline or an explanation of why it is not a
+  vulnerability, within 15 business days.
+- Credit in the release notes when a report leads to a fix, unless you prefer
+  otherwise.
+
+Please give us a reasonable window to publish a fix before disclosing publicly.
+
+## Scope
+
+In scope: the published `manifoldbt` package, its data connectors, and its CLI.
+
+Of particular interest: anything that lets untrusted input reach code execution.
+The library parses files and network responses that a user did not write,
+including CSV imports and connector payloads, and it deserializes stored data.
+
+Out of scope: the website, third-party forks and redistributions, and findings
+that require an attacker to already control the machine running the backtest.