# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| latest  | :white_check_mark: |

## Reporting a Vulnerability

If you discover a security vulnerability, please report it by opening a GitHub issue with the `security` label. Do NOT open a public issue for security flaws that could expose user data.

We will acknowledge your report within 48 hours and work on a fix.

## Security Considerations for Users

⚠️ **This tool handles OAuth tokens and email passwords. Please follow these security best practices:**

1. **Never commit `.env` files** — they contain passwords and token paths
2. **Protect the `tokens/` directory** — OAuth tokens grant access to your email
3. **Use file permissions**: `chmod 600 tokens/*.token`
4. **Never share log files** — they may contain email content snippets
5. **Rotate tokens** by deleting the token file and reauthorizing periodically
6. **Use a dedicated Azure App** — don't reuse OAuth credentials from other apps