# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 2.0.x   | :white_check_mark: |
| < 2.0   | :x:                |

## Reporting a Vulnerability

We take the security of QWED very seriously. If you discover a security vulnerability, please report it to us immediately.

### How to Report

Please do **not** report security vulnerabilities through public GitHub issues.

Instead, please report them via email to:
**rahul@qwedai.com**

Please include as much information as possible to help us reproduce and fix the issue, including:
*   Steps to reproduce the vulnerability.
*   Relevant code or configuration.
*   The potential impact of the vulnerability.

### Response Timeline

We are committed to addressing security issues promptly.
*   We will acknowledge your report within **24 hours**.
*   We will work with you to understand and resolve the issue.
*   We will keep you updated on our progress.

## Security Issue vs. Bug

To help us triage issues effectively, please distinguish between security issues and bugs:

*   **Security Issue:** A vulnerability that compromises the confidentiality, integrity, or availability of the system (e.g., SQL injection, XSS, unauthorized access, sensitive data leak). Please report these via email as described above.
*   **Bug:** A functional defect or unexpected behavior that does not have security implications (e.g., UI glitch, incorrect calculation, crash without exploitability). Please report these via the [GitHub Issue Tracker](https://github.com/qwed-platform/qwed-open/issues).

Thank you for helping keep QWED secure!

