If you discover a security vulnerability in any GameVox product, please report it responsibly:

1. Do not open a public GitHub issue.
2. Email security@gamevox.com with:
   • A description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Any suggested fix (optional)
3. You will receive an acknowledgement within 48 hours.
4. We will work with you to understand and resolve the issue before any public disclosure.

This policy covers all repositories under the GameVoxVoice organization, including but not limited to:

• Website (gamevox.com)
• Desktop, Web, Android, and iOS clients
• Agent Dashboard
• Help Center
• Backend services

Individual repositories may include their own SECURITY.md with additional scope or instructions. Where a repo-level policy exists, it takes precedence over this org-level default.

We consider security research conducted in good faith to be authorized. We will not pursue legal action against researchers who:

• Make a good-faith effort to avoid privacy violations, data destruction, or service disruption
• Report findings promptly and do not exploit them beyond what is necessary to demonstrate the issue
• Allow reasonable time for remediation before disclosure