# Security policy

## Supported versions

Security fixes target the latest published release. Older releases may receive
no fixes or support commitment.

## Reporting a vulnerability

Use GitHub's private vulnerability reporting for this repository. If that
option is unavailable, contact the maintainer through the contact method on the
BytesAndCoffee GitHub profile and ask for a private reporting channel.

Do not open a public issue for an unpatched vulnerability. Do not include live
tokens, credentials, private card data, analytics databases, or production
configuration in a report.

Useful reports include the affected version, impact, reproduction steps against
a local test deployment, and a suggested mitigation. Receipt or remediation
times are not guaranteed; this is a volunteer project with no SLA.

Card-pack copyright or attribution concerns are not software vulnerabilities.
Report them privately when they involve personal data or sensitive material;
otherwise use an issue and identify the pack and provenance record.