# Security Policy

## Supported versions

Security fixes are applied to the latest `main` branch and the most recent tagged release. Older releases may not receive fixes.

## Reporting a vulnerability

Please do not disclose exploitable details in a public issue. Use GitHub's **Report a vulnerability** flow on the repository's Security tab. If private reporting is unavailable, open a minimal issue asking for a private contact channel and avoid including proof-of-concept code or sensitive data.

Include the affected version or commit, a concise impact description, reproduction steps, and any suggested mitigation. We will acknowledge reports as soon as practical and coordinate a fix and disclosure timeline with the reporter.