# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| Latest  | Yes       |
| Older   | No        |

Only the latest release receives security updates.

## Reporting a Vulnerability

**Do not open a public issue.**

Please report vulnerabilities through one of these channels:

1. **GitHub Security Advisories** (preferred): [Report a vulnerability](https://github.com/mlorentedev/pdf-modifier-mcp/security/advisories/new)
2. **Email**: mlorentedev@gmail.com

### Include in your report

- Description of the vulnerability
- Steps to reproduce
- Potential impact

### Response timeline

- **Acknowledgment**: Within 48 hours
- **Assessment**: Within 1 week
- **Fix**: Targeting 2 weeks for critical issues

## Scope

This policy covers:

- `pdf-modifier-mcp` Python package
- MCP server and CLI interfaces

Out of scope:

- Third-party dependencies (report upstream)
- User-generated PDF content
