# Security policy

## Supported version

Security fixes are generally prepared for the current released version. Update older installations before requesting a detailed analysis whenever possible.

## Reporting a vulnerability

Do not publish credentials, tokens, personal data, internal addresses, or exploitable details in a public issue.

Use the repository's private security-reporting feature when available. Otherwise, use the private contact listed in the repository and disclose only the information required to reproduce the issue.

A report should include:

- affected version
- affected function
- reproducible steps
- potential impact
- relevant log excerpts with all secrets removed

Only test systems for which you have explicit authorization.