Email security@amodb.dev with a description of the problem and the steps to reproduce it. Include the affected repository, the version and the impact you see.

Please do not open a public issue or pull request for a security report. Never include a live API key in a report. If a key was exposed, revoke it in your account at https://amodb.dev and create a new one.

• We reply to every report within 72 hours.
• We confirm the problem, tell you how severe we think it is and agree on a fix timeline with you.
• We credit you in the release notes when the fix ships, unless you ask us not to.

This policy covers every repository in the AmoDataBase organization and the API at https://api.amodb.dev. Problems in the API itself, such as key checks, rate limits or exposed data, are in scope for the same address.

Only the latest release of each package receives security fixes.