If you discover a security vulnerability in the PACT specification or reference implementation, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please email security@tailor.au with:

1. A description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact assessment
4. Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Assessment: Within 1 week
• Fix/Disclosure: Coordinated with reporter

This policy covers:

• The PACT specification (this repository)
• The reference implementation (Tailor)
• JSON Schema definitions
• Example code in this repository