# Security Policy

## Supported Versions

This project follows best-effort security support for recent releases.

- Latest released version on PyPI: supported
- Older versions: security fixes are not guaranteed

If you are using an older version, upgrade to the latest release before
reporting a vulnerability.

## Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Instead, use one of the following private reporting channels:

- GitHub Security Advisories (preferred, if enabled for the repo)
- If advisories are not available, open an issue with minimal details and ask
  maintainers for a private follow-up

When reporting, include:

- A clear description of the issue and impact
- Steps to reproduce (or a proof-of-concept) if available
- Affected versions and environment details
- Any mitigation or workaround you have found

## Response Process

Maintainers will:

- Acknowledge receipt as soon as practical
- Assess severity and scope
- Prepare a fix and coordinate a release
- Credit reporters when appropriate (if desired)
