# Security Policy

## Supported Versions

We actively provide security updates for the following versions of cb-events:


| Version | Supported          |
| ------- | ------------------ |
| 6.x.x   | :white_check_mark: |
| 5.8.2   | :white_check_mark: |
| 5.8.1 and earlier   | :x:                |

## Reporting a Vulnerability

**Please do not open a public GitHub issue for security vulnerabilities.**

If you discover a potential security flaw in this project, please report it by:

1.  **Email:** Send a detailed description to security@reid.ca.
2.  **Details to Include:**
    *   The version of the library used.
    *   A Proof of Concept (PoC) or steps to reproduce.
    *   The potential impact of the vulnerability.

## Our Response Process

*   **Acknowledgment:** You will receive an acknowledgment of your report within 5 days.
*   **Validation:** We will keep you updated as we investigate and verify the issue.
*   **Fix:** Once a fix is ready, we will release a patched version and coordinate a public disclosure date with you.
*   **Credit:** We are happy to credit you for your discovery in our release notes (unless you prefer to remain anonymous).

## Disclosure Policy

We follow a coordinated disclosure model. We ask that you do not share details of the vulnerability publicly until a fix has been released to protect our users.
