# Security Policy

## Supported Versions

| Version | Supported |
| --- | --- |
| 0.x (latest) | Yes |
| older than latest minor | No |

## Reporting a Vulnerability

If you discover a security vulnerability in Vyro:

1. Open a private GitHub Security Advisory in `vietrix/vyro` (preferred).
2. Do **not** open a public issue for security vulnerabilities.
3. Include:
   - affected version
   - reproduction steps
   - impact assessment
   - optional mitigation ideas

If Security Advisories are temporarily unavailable, contact repository
maintainers privately in the Vietrix organization and include the same details.

## Disclosure Process

- We aim to acknowledge reports within **72 hours**.
- We aim to provide an initial triage within **7 days**.
- Fix timelines depend on severity and complexity.
- Once a fix is available, we will publish a coordinated disclosure with
  patched versions and upgrade guidance.
