| 1 | # Security Policy |
| 2 | |
| 3 | ## Supported Versions |
| 4 | |
| 5 | Security fixes are applied on a best-effort basis to the latest `main` branch and the most recent published release line. |
| 6 | |
| 7 | ## Reporting a Vulnerability |
| 8 | |
| 9 | Please do **not** disclose suspected vulnerabilities in public GitHub issues. |
| 10 | |
| 11 | Preferred process: |
| 12 | |
| 13 | 1. Use GitHub private vulnerability reporting for this repository if it is available in the repository security settings. |
| 14 | 2. If private reporting is not available, open a minimal public issue that only requests a private contact channel and does **not** include vulnerability details, proof-of-concept code, payloads, or sensitive file paths. |
| 15 | 3. Wait for a maintainer response before sharing any technical details publicly. |
| 16 | |
| 17 | When reporting a vulnerability privately, include: |
| 18 | |
| 19 | - affected commit, tag, or release version |
| 20 | - attack surface or vulnerable endpoint |
| 21 | - impact summary |
| 22 | - reproduction conditions |
| 23 | - suggested remediation, if available |
| 24 | |
| 25 | ## Disclosure Expectations |
| 26 | |
| 27 | - Please give maintainers reasonable time to investigate and prepare a fix before public disclosure. |
| 28 | - Once a fix is available, coordinated public disclosure is welcome. |
| 29 |