# Security policy — `mgf-logship`

## Supported versions
The latest `0.1.x` release receives security fixes. Older versions are not maintained.

## Reporting a vulnerability
Email the maintainer (mgf-common owner, `bassam@magogi.org`) with details. Please do **not**
open a public issue for an undisclosed vulnerability. Expect an acknowledgement within ~7 days.

## Notes specific to mgf-logship
- The shipper redacts records via `mgf.common` `Redactor` **before** queueing; the collector
  bearer token lives only in the `Authorization` header, never in a shipped record body.
- The stub `collector` is for dev/test, not a hardened production sink.
