# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 2.0.x   | :white_check_mark: |
| < 2.0   | :x:                |

## Reporting a Vulnerability

We take the security of QWED very seriously. If you discover a security vulnerability, please report it to us immediately.

### How to Report

Please do **not** report security vulnerabilities through public GitHub issues.

Instead, please report them via email to:
**rahul@qwedai.com**

Please include as much information as possible to help us reproduce and fix the issue, including:
*   Steps to reproduce the vulnerability.
*   Relevant code or configuration.
*   The potential impact of the vulnerability.

### Response Timeline

We are committed to addressing security issues promptly.
*   We will acknowledge your report within **24 hours**.
*   We will work with you to understand and resolve the issue.
*   We will keep you updated on our progress.

### Reporter Credit

We value the security community and will publicly credit vulnerability reporters who responsibly disclose issues and do not request anonymity. Credit will be given in our release notes and SECURITY.md history.

## Security Issue vs. Bug

To help us triage issues effectively, please distinguish between security issues and bugs:

*   **Security Issue:** A vulnerability that compromises the confidentiality, integrity, or availability of the system (e.g., SQL injection, XSS, unauthorized access, sensitive data leak). Please report these via email as described above.
*   **Bug:** A functional defect or unexpected behavior that does not have security implications (e.g., UI glitch, incorrect calculation, crash without exploitability). Please report these via the [GitHub Issue Tracker](https://github.com/qwed-platform/qwed-open/issues).

Thank you for helping keep QWED secure!

