# Security Policy

## Supported Versions

| Version | Supported          |
|---------|--------------------|
| 1.x     | :white_check_mark: |
| < 1.0   | :x:                |

## Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it
responsibly.

**Do NOT open a public GitHub issue.**

Send an email to **security@ljwx.com** with the following information:

- Description of the vulnerability and its potential impact.
- Steps to reproduce the issue, including any proof-of-concept code.
- Affected version(s).
- Any suggestions for a fix (optional but appreciated).

### Response SLA

| Stage                | Target Time |
|----------------------|-------------|
| Acknowledgement      | 2 business days |
| Initial assessment   | 5 business days |
| Fix or mitigation    | 14 calendar days (critical), 30 calendar days (medium/low) |
| Public disclosure    | After fix is released and users have had reasonable time to upgrade |

We follow the principle of **coordinated vulnerability disclosure**. We will
credit reporters unless they wish to remain anonymous.

### Scope

This policy covers the `java-service-template` repository and its published
Docker images. Third-party dependencies are monitored via OWASP
Dependency-Check and Dependabot; please report upstream vulnerabilities
directly to the respective maintainers.

### Security Updates

Security patches are released as point versions (e.g., 1.0.1) and announced
via the CHANGELOG.md and GitHub Releases.