If you discover a security vulnerability, please report it privately:

Email: helge.sverre@gmail.com

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

Do not:

• Open a public GitHub issue for security vulnerabilities
• Disclose the vulnerability publicly before it's fixed

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Fix timeline: Depends on severity, typically 1-4 weeks

This policy applies to:

• The sql-splitter CLI tool
• Code in the main repository

Out of scope:

• Third-party dependencies (report to their maintainers)
• Issues in forks or unofficial distributions