# Security

## Supported versions

This policy covers the `0.1.1` source line. Registry availability should be checked before installation; this policy does not establish publication status. No separate historical maintenance branch is offered. Reports should identify the exact commit, MoonBit version, operating system and Broker version. Compatibility and verification scope are documented in the [capability matrix](docs/capabilities.md).

## Reporting a vulnerability

GitHub private vulnerability reporting is not enabled, and no dedicated private contact is currently advertised.

Do not post vulnerability details, exploits, credentials, private keys or production logs in a public issue. Open a minimal [contact request](https://github.com/pangbit/moonpulsar/issues/new) asking the maintainer to arrange a private channel, without disclosing the affected system or technical details. Wait until that channel is agreed before sharing sensitive information. This initial request is public.

Once a private channel is available, include the affected commit, a minimal reproduction using disposable data, impact and any proposed mitigation. No response-time SLA is currently offered.

For ordinary bugs and usage questions, use [GitHub Issues](https://github.com/pangbit/moonpulsar/issues). The repository's TLS and encryption keys are public test fixtures and must not be used for real deployments.