# Security Policy

## Supported versions

Only the latest release receives security fixes.

## Reporting a vulnerability

Please **do not** open a public GitHub issue for security vulnerabilities.

Instead, report them privately via [GitHub's private vulnerability reporting](https://github.com/Get-Coral/aurora/security/advisories/new) or by emailing [aurora@getcoral.dev](mailto:aurora@getcoral.dev).

Include as much detail as possible:

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Any suggested fixes

You can expect an acknowledgement within 72 hours and a fix or mitigation plan within 14 days for confirmed issues.