# Security Policy

## Reporting a Vulnerability
Report it privately on GitHub: **Security → Report a vulnerability** on this repository. Please do not open a public issue for it.

Response SLA: 72 hours acknowledgement.

## Supported Versions
The latest release (the `latest` image) gets the security fixes; **Admin → Updates** tells when one is out.

## Disclosure
Coordinated disclosure preferred. 30-day window before public disclosure.

## Out of Scope
Self-hosted deployments by third parties.