# Security Policy

## Supported Versions

- `3.0.x`: supported
- `<3.0.0`: best effort only

## Reporting a Vulnerability

Please report vulnerabilities privately:

- GitHub private advisory: https://github.com/412984588/clawpolicy/security/advisories/new
- Security email: not configured (use private advisory link above)

Do **not** open public issues for unpatched vulnerabilities.

## Response Targets

- Initial response: within 72 hours
- Triage decision: within 7 days
- Patch target: based on severity and impact
