# Security policy

Report suspected vulnerabilities privately through https://yatoon.com/ with version and reproduction details. Do not send customer data, access tokens, webhook secrets, card data, or production database exports. Automated release gates are not represented as independent security certification.