Ceres is currently in early development (pre-v1.0). Security updates will be provided for the latest development version.

If you discover a security vulnerability in Ceres, please report it privately:

1. Do not open a public issue
2. Email the maintainers or use GitHub's private vulnerability reporting
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We will respond within 48 hours and work with you to address the issue.

When using Ceres:

• API Keys: Never commit API keys or database credentials to version control
• Database: Use strong passwords for PostgreSQL and restrict network access
• Input Validation: Be cautious when harvesting from untrusted data portals
• Dependencies: Keep Rust dependencies updated with cargo update

Once a security issue is fixed, we will:

1. Release a patch
2. Publish a security advisory
3. Credit the reporter (unless they prefer anonymity)