# Security Policy

## Supported Versions

We support the latest released minor series. Older series may not receive security fixes.

| Version | Supported          |
| ------- | ------------------ |
| Latest  | :white_check_mark: |
| < Latest | :x:                |

## Reporting a Vulnerability

Please report security issues privately so we can address them promptly.

### How to Report

**Option 1: Private Security Advisory (Recommended)**
- Open a private security advisory: [Link to GitHub Security Advisories]
- Or email: [Your security email]

**Option 2: Direct Email**
- Email: [Your security email]
- Use a descriptive subject line
- Include steps to reproduce and environment details

### What to Include

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

### Response Timeline

- **Acknowledgment**: Within 72 hours
- **Initial Assessment**: Within 7 days
- **Status Update**: Every 14 days until resolved

### Disclosure Policy

- Do not file public GitHub issues for security problems
- We will coordinate disclosure with you after the fix is ready
- We will credit you in the security advisory (if desired)

## Security Best Practices

When using this project:

- Keep dependencies up to date
- Review security advisories regularly
- Follow secure coding practices
- Report vulnerabilities responsibly

## Notes

- We take security seriously and appreciate your help
- All security reports will be handled with confidentiality
- We will work with you to ensure a proper resolution


