Currently, TradeFlow is an active engineering and research project. Only the main branch is actively supported with security updates.

Security is highly important to us. If you discover a security vulnerability in this repository (e.g., exposed credentials, unsafe defaults, unsafe deserialization, or logic flaws that bypass validation), please do not report it publicly via GitHub issues.

Instead, please privately report it by:

1. Creating a private security advisory on GitHub (if available on the repository).
2. Contacting the maintainers directly.

You should receive a response within 48 hours. If the vulnerability is confirmed, we will work with you to patch the issue and properly disclose it once the patch is available.

Please include:

• A description of the vulnerability.
• Steps to reproduce it.
• Possible impacts or risks.
• Proposed remediation (optional but appreciated).