# Security Policy

## Supported Versions

BSSUnfold follows semantic versioning. Only the latest release receives security updates.

| Version | Supported          | Security Updates |
|---------|--------------------|------------------|
| >=0.1.0 | ✅ Yes             | ✅ Yes           |

## Reporting a Vulnerability

Thank you for taking the time to report a security issue in BSSUnfold, a Python package for neutron spectrum unfolding from Bonner Sphere Spectrometer measurements.

Please do not report security vulnerabilities through public GitHub issues, discussions, or other public forums.

**Preferred reporting method:** Email vulnerabilities to the maintainer at a secure address (e.g., kchizhov@jinr.ru if available, or check the repository owner details). Include "BSSUnfold Security Vulnerability" in the subject line.

## What We Accept

We encourage responsible disclosure. Accepted reports include:
- Supply chain vulnerabilities in dependencies
- Other security issues

We do not accept reports for:
- Theoretical issues without exploit
- Previously known vulnerabilities
- Issues in third-party dependencies (report to upstream)

## Disclosure Timeline

- Initial acknowledgment: ASAP
- Assessment and fix plan: ASAP
- Patch release: ASAP
