# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| Latest  | :white_check_mark: |
| < Latest | :x:               |

Only the latest released version receives security updates.

## Reporting a Vulnerability

If you discover a security vulnerability in HushLog, please report it responsibly using [GitHub's private vulnerability reporting](https://github.com/FelipeMorandini/hushlog/security/advisories/new).

**Do not open a public issue for security vulnerabilities.**

### What to include

- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Any suggested fixes (optional)

### Response Timeline

- **Acknowledgment:** Within 48 hours of your report.
- **Initial assessment:** Within 5 business days.
- **Fix and release:** We aim to release a patch within 14 days of confirming the vulnerability, depending on severity and complexity.

### Responsible Disclosure

We kindly ask that you:

- Allow us reasonable time to address the issue before public disclosure.
- Avoid exploiting the vulnerability beyond what is necessary to demonstrate it.
- Do not access or modify other users' data.

We appreciate your help in keeping HushLog and its users safe.
