# Security Policy

## Supported versions

Pocketdex is a rolling static web app — only the current `main` (and
whatever is deployed from it) is supported. There are no maintenance
branches.

## Reporting a vulnerability

Please **don't** open a public issue for a security problem.

Use GitHub's **private vulnerability reporting** (the _Report a
vulnerability_ button under the repository's _Security_ tab). Include what
you found, how to reproduce it, and the impact you think it has. You'll get
an acknowledgement as soon as possible.

Since Pocketdex has no backend and stores everything in the visitor's own
browser, the realistic surface is: the service worker / caching, the
save-file parser (`src/lib/savedex.js`) operating on untrusted binary
input, and the JSON backup import.

## Known issues

None currently. `npm audit` is clean as of the last dependency bump
(Vite 6, esbuild 0.25). CI does not yet gate on `npm audit`; run it
locally when touching dependencies.