for-promise/SECURITY.md

A lightweight utility to run async loops with full control using Promises — like for, forEach, and while, but smarter.

# 🔐 Security Policy

## 🛠 Supported Versions

We provide security updates for the latest published version of this package:

| Version        | Supported |
|----------------|-----------|
| latest (`npm`) | ✅        |
| older versions | ❌        |

If you’re using an older version, we highly recommend updating to the latest version available on [npm](https://www.npmjs.com/package/for-promise).

---

## 📣 Reporting a Vulnerability

If you discover any security vulnerability in **ForPromise**, **please report it responsibly and privately**.

To report a vulnerability, use one of the following methods:

- 📧 **Email:** `tiny@puddy.club`
- 🛡️ **GitHub Security Advisories:** Use the "Report a vulnerability" feature on the repository page.

We ask you **not to disclose vulnerabilities publicly** before we have had a chance to investigate and release a fix.

We aim to respond to valid reports within **72 hours** and will try to release a fix within **7 working days**, depending on complexity and impact.

---

## 📝 Disclosure Process

1. You report a security issue privately.
2. We confirm the vulnerability and begin internal investigation.
3. A patch is prepared, tested, and released.
4. A public disclosure and GitHub Security Advisory may be published.
5. If you request it, we will credit you as the reporter (unless anonymity is preferred).

---

## 🙏 Thank You

Thanks for helping us make **forPromise** a safer and more reliable project! 💙  
Your contribution to open-source security matters.