# Security Policy

## Reporting a Vulnerability

Please report suspected vulnerabilities **privately** via GitHub's
[Private Vulnerability Reporting](https://github.com/3ncr/tokencrypt-python/security/advisories/new)
on the Security tab. Do not file public issues for security-sensitive reports.

We aim to acknowledge reports within 5 business days and to ship a fix or
documented mitigation within 30 days for confirmed vulnerabilities, depending
on severity and complexity.

## Supported Versions

The [3ncr.org v1 envelope](https://3ncr.org/1/) is the only supported format.
Security fixes land on the latest release of the `v1.x` line.

| Version | Supported |
| ------- | --------- |
| 1.x     | Yes       |
| < 1.0   | No        |
