# Security Policy

## Supported Versions

We actively maintain **EdgyGraph** and provide security updates for the latest stable versions.  
Users are encouraged to use the **latest release** for security fixes.

| Version | Supported |
| ------- | --------- |
| < 1.0   | :x: |

> Note: Since EdgyGraph is pre-1.0, APIs may change, and older versions will not receive security patches.

---

## Reporting a Vulnerability

We take security issues seriously. If you discover a potential vulnerability, please follow these steps:

1. **Confidential Reporting**  
   Send an email to: `mathis.siebert@gmail.com`
   - Do **not** post security issues in public issues or discussion forums.  
   - Include:
     - Detailed description of the issue  
     - Steps to reproduce  
     - Affected version(s)  
     - Any suggested mitigations (optional)

2. **Response Timeline**  
   - We aim to acknowledge all reports within **48 hours**.  
   - A security fix will be evaluated and, if feasible, released **as soon as possible**.  
   - You will be updated during the fix process.

3. **Disclosure Policy**  
   - If a report is accepted and a fix is released, the details may be publicly disclosed in release notes.  
   - If a report is declined (not reproducible or not a security risk), we will provide an explanation.

4. **Credits**  
   - We welcome reporting credit. If you wish, your name will appear in release notes as the security reporter.

---

## Recommended Practices for Users

- Always use the **latest release** of EdgyGraph.  
- Avoid using versions marked as unsupported.  
- Review and restrict any untrusted input in states.
