# Security Policy

## Supported versions

Only the latest tagged v0.1.x release is supported during the design-partner phase.

## Report a vulnerability

Email `support@onchainoncall.com` with the subject `OASG security report`.

Include the affected version, a minimal reproduction, expected impact, and any suggested mitigation. Do not send private keys, seed phrases, production credentials, customer data, or live exploit payloads against third-party systems.

We will acknowledge a complete report within three business days and coordinate remediation and disclosure based on severity. This project does not currently operate a paid bug-bounty program.

## Ordinary defects

Use [GitHub Issues](https://github.com/onchainoncall/open-agent-spend-guard/issues) for ordinary defects and compatibility gaps. Do not include an unpatched vulnerability in a public issue.
