# Security Policy
## Reporting a Vulnerability
FinPulse is an educational and portfolio project.
If you discover a potential security vulnerability, please do not disclose sensitive details publicly through a GitHub issue.
Instead, contact the repository owner privately through the contact information available on the author's GitHub profile.
## Security Guidelines
When running FinPulse locally or in a deployed environment:
- Never commit .env files or credentials to the repository.
- Use environment variables for secrets and database credentials.
- Do not expose PostgreSQL credentials in source code.
- Do not publish Kafka credentials or private infrastructure configuration.
- Keep dependencies updated.
- Do not use real financial or personally identifiable transaction data.
## Scope
FinPulse is not intended for processing real financial transactions or production financial data. It is a portfolio project demonstrating software engineering concepts for financial risk monitoring.