# Security Policy

`mgf-brand-web` is a federation sibling of [`mgf-common`](https://codeberg.org/magogi-admin/mgf-common).
It is a **pure asset package** — tokenized CSS, self-hosted fonts, and SVG assets
shipped as package data, plus a tiny `static_dir()` accessor. It has **no runtime
dependencies, no executable service, and handles no credentials or user input**,
so its security surface is limited to the integrity of the shipped static assets.

## Supported versions

In the 0.x window, **only the latest MINOR receives fixes** (per
[SemVer 0.x](https://semver.org/#spec-item-4) and rule **AP-03**). Fixes ship as
the next PATCH on the latest MINOR.

| Version | Supported |
|---------|-----------|
| `0.1.x` | ✅ — latest MINOR |
| `< 0.1` | ❌ — pre-publish development |

## A note on the assets

The bundled fonts are OFL; the logo/pattern SVGs originate from the `mgf-brand`
source of record. Consumers serve these as static files — keep your own
Content-Security-Policy appropriate to your surface.

## Reporting a vulnerability

**Please do not open a public issue or pull request** until we have had a chance
to respond. Email the maintainer (see the Codeberg profile for `magogi-admin`)
with a description, reproduction, and impact.
