# Security Policy ## Supported versions During pre-1.0, only the latest tagged release is supported with security fixes. From 1.0 onward, an LTS policy will be defined in the project plan (`plan.md` §∞.6). ## Reporting a vulnerability **Do not open a public GitHub issue for security reports.** Please report vulnerabilities privately to **security@apprafter.dev** (placeholder until a real address is provisioned). Include: - A description of the issue and its impact. - Steps to reproduce, with minimal manifests / commands. - The affected version (`apprafter version` output, or the commit SHA if running from source). - Any suggested mitigation. We aim to: - Acknowledge reports within **72 hours**. - Provide an initial assessment within **7 days**. - Coordinate disclosure timing with the reporter; default embargo window is **90 days**. ## PGP A PGP key for the security team will be published here once the team is established. Until then, request encrypted communication via the email address above and we will provide a key. ## Hall of fame Once the platform reaches 1.0 and a bug-bounty programme is in place, valid reports will be credited here unless the reporter prefers anonymity.