Available languages:

• English
• Spanish

This project is academic and private.
Security updates are applied only to the active development branch (develop) and the latest stable release (main).
Older versions or tags are not maintained.

Please do not disclose vulnerabilities publicly in Issues or Pull Requests.

Instead, report them privately to the maintainers:

• Contact: contact.demyteam@gmail.com
• Or via the private channel indicated in our team’s Discord.

When reporting, please include:

• A description of the issue and its potential impact.
• Steps to reproduce the vulnerability (screenshots, reproduction steps, or sample data).
• Any logs, crash reports, or Flutter debug outputs (shared privately, never in public).
• Suggested mitigation or fix (if known).

We will acknowledge receipt of your report within 48 hours and aim to provide an initial assessment within 5 working days.

This policy applies to:

• The Flutter application codebase (Dart, Flutter SDK, provider/BLoC state management, etc.).
• App configurations, pubspec.yaml dependencies, and environment files.
• Authentication, API integrations, and data storage within the app.

This policy does not apply to:

• External packages or plugins (report issues directly to their maintainers).
• Emulator, simulator, or device issues unrelated to the app itself.
• Academic or classroom-related feedback (should be handled via the course platform).

By following this policy, you help us address security issues responsibly.
We will credit contributors in internal documentation, but no public disclosure will be made without team agreement.

Note: This repository is an academic and private project. External contributions are not accepted.