# Security Policy

## Supported Versions

Only the current stable release line receives security fixes. Older
releases are best-effort and may not get patches. The stable line is the
most recent minor version tagged on this repo (see
[Releases](https://github.com/floci-io/floci/releases)).

## Reporting a Vulnerability

Please do **not** open public GitHub issues for security vulnerabilities.

Report them privately via
[GitHub private vulnerability reporting](https://github.com/floci-io/floci/security/advisories/new).
This is the only supported reporting channel and produces a private
thread with the maintainers.

Expect an initial acknowledgement within a few business days. Once the
report is confirmed, we will coordinate a fix, a release, and (where
appropriate) a security advisory with CVE assignment.

See [CONTRIBUTING.md](CONTRIBUTING.md#reporting-security-issues) for the
corresponding contributor-facing note.