# Security policy

## Supported versions

Security fixes target the latest plugin release. Older releases do not have a separate security maintenance commitment.

## Reporting a vulnerability

Use GitHub's [private vulnerability reporting](https://github.com/EllipticSet/unraid-header-fix/security/advisories/new), available under **Security → Advisories → Report a vulnerability**.

Include the affected plugin and Unraid versions, reproduction steps and potential impact. Remove credentials and private information from attachments.

Do not publish exploit details in a public issue or pull request while a report is being assessed. Ordinary bugs and feature requests belong in [Issues](https://github.com/EllipticSet/unraid-header-fix/issues).

Reports are reviewed as time permits. Updates and any disclosure plan will be discussed in the private report; no fixed response or remediation deadline is promised.

## Scope

This repository includes the plugin installer and removal scripts and a script added to the Unraid WebGUI. Reports affecting these components are welcome. Issues in Unraid itself or in other plugins should be reported to their respective projects.