# Security Policy

## Supported Versions

Open Source Barware is under active development. Security fixes are applied to
the latest released version and the `main` branch.

| Version | Supported          |
| ------- | ------------------ |
| latest  | :white_check_mark: |
| older   | :x:                |

## Reporting a Vulnerability

**Please do not report security vulnerabilities through public GitHub issues.**

Instead, use one of these private channels:

1. **GitHub Private Vulnerability Reporting** (preferred) —
   go to the [Security tab](https://github.com/RichardBJamison/open-source-barware/security)
   and click **Report a vulnerability**.
2. **Email** — **richard@opensourcebarware.com** with the subject line
   `SECURITY: <short description>`.

Please include:

- A description of the vulnerability and its impact
- Steps to reproduce
- Affected version, page, or file
- Any suggested fix

## What to expect

- We aim to acknowledge reports within **72 hours**.
- We will keep you updated as we investigate and fix the issue.
- We will credit you in the release notes unless you prefer to remain anonymous.

Thank you for helping keep Open Source Barware and its users safe.
