# Security Policy

## Reporting a vulnerability

Please **do not** open a public issue for security vulnerabilities.

Report privately instead:

- Open a [private security advisory](https://github.com/OWNER/REPO/security/advisories/new), or
- Email the maintainers (see repository profile for contact).

You should receive a response within 7 days. Please include:

- Affected version(s) / commit
- Steps to reproduce
- Impact description

## Supported versions

| Version | Supported |
|---------|-----------|
| latest  | ✅ |
| older   | ❌ (best effort) |

## Disclosure

We appreciate responsible disclosure. Once a fix is released, we will
acknowledge the reporter in the release notes (unless anonymity is requested).