init

SECURITY.md

@@ -0,0 +1,77 @@
+# 🔐 Security Policy
+
+## 📆 Supported Versions
+
+| Version         | Supported |
+|------------------|-----------|
+| `main` (latest)  | ✅ Yes     |
+| older versions   | ❌ No      |
+
+We only support the latest `main` branch for active development and security updates.
+
+---
+
+## 📣 Reporting a Vulnerability
+
+If you discover a security vulnerability, **please report it responsibly**.  
+**Do not** create a public GitHub issue.
+
+### 🔒 How to Report
+
+Send a private disclosure message to:
+
+- **Telegram (Preferred):** [@mortdeus](https://t.me/mortdeus)  
+
+
+We will acknowledge your report within **48 hours** and work with you on a timely resolution.
+
+---
+
+## 📌 What to Report
+
+Please report vulnerabilities such as:
+
+- Private key leakage
+- Transaction spoofing or unauthorized trade execution
+- Unsafe default config behavior (e.g. unsafe slippage)
+- MEV or sniper logic bugs causing unintended trades
+- Telegram command injection / exploits
+- Dependency vulnerabilities (e.g. `node_modules` packages with CVEs)
+
+---
+
+## ❌ Out of Scope
+
+The following are **not considered security issues**:
+
+- Losing funds due to poor strategy configuration
+- Market losses (slippage, impermanent loss, front-running)
+- Insecure user environments (e.g. leaked `.env`)
+- User misconfiguration or misuse
+
+---
+
+## 🛡️ Security Best Practices for Users
+
+- Always use a **burner wallet** during development and testing
+- Never commit your `.env` or `PRIVATE_KEY` to GitHub
+- Set proper file permissions for `.env`
+- Use strong passwords and 2FA on GitHub and Telegram
+- Run the bot on a secure, trusted VPS or local machine
+- Review PRs and third-party code before merging
+
+---
+
+## 🤝 Disclosure Process
+
+1. Report vulnerability privately (Telegram or email)
+2. We'll confirm receipt within 48 hours
+3. We'll investigate and patch within 7–14 days
+4. Optional: Public CVE disclosure with your credit
+
+---
+
+Thanks for making **Solana Sniper Copy MEV Trading Bot** safer for the entire Solana community.  
+Security is a shared responsibility — and we appreciate your help.
+
+*Maintained by [@mortdeus](https://github.com/mortdeus)*