From 25c3999be54e358bb7343a72223e4b1110e64e61 Mon Sep 17 00:00:00 2001
From: HetCreep <239326951+HetCreep@users.noreply.github.com>
Date: Fri, 16 Oct 2026 05:35:52 +0700
Subject: [PATCH] docs: add a security policy (#795)

Co-authored-by: Jeffrey <9938813+Raphire@users.noreply.github.com>
---
 .github/SECURITY.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/SECURITY.md

diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000..c14679c
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release and the current `master` branch are supported. Please verify that the issue exists in the [latest release](https://github.com/Raphire/Win11Debloat/releases/latest) before reporting it.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately through GitHub. **Do not open a public issue.**
+
+To submit a report:
+
+1. Go to the repository's [Security tab](https://github.com/Raphire/Win11Debloat/security).
+2. Select **Report a vulnerability**.
+3. Describe the issue, including the affected version, steps to reproduce, and potential security impact.
+
+Because Win11Debloat runs with administrator privileges, security issues that could allow unintended or unauthorized actions are considered in scope.
+
+This project is maintained by volunteers. Security reports are handled on a best-effort basis, without guaranteed response times.
+
+## What Is Not a Vulnerability
+
+- **Antivirus false positives:** Report these as regular issues.
+- **Intended functionality:** Changes such as removing apps or disabling telemetry are not security vulnerabilities. Report unexpected behavior as a regular issue.