# Security Policy

## Supported versions

The current supported public release is listed on the
[latest release page](https://github.com/IcyShadow5/RepoManager/releases/latest). The 0.1.x
line is the only line intended to receive security fixes. This policy must be
updated if that support position changes.

## Reporting a vulnerability

Do not open a public issue for an unresolved vulnerability.

GitHub Private Vulnerability Reporting is enabled on the public repository
(verified 2026-10-05). Use [Report a vulnerability](https://github.com/IcyShadow5/RepoManager/security/advisories/new).
If GitHub Private Vulnerability Reporting is unavailable, email
[icyshadow5.devsec@outlook.com](mailto:icyshadow5.devsec@outlook.com).
This fallback mailbox is for private security/moderation reports and privacy
questions or requests under the [privacy policy](PRIVACY.md), not general
product support or website contact. Do not send secrets or exploit details
through public issues. Source checkouts and local builds do not establish
publication or support; use the published release information linked above.

A useful report should include:

- the affected RepoManager version or source revision;
- the affected Windows and Python versions, where relevant;
- the prerequisites and steps needed to reproduce the issue;
- the observed impact and affected data or trust boundary;
- logs, screenshots, or a proof of concept with credentials and personal data
  removed;
- any known workaround or suggested remediation.

Please allow reasonable time for confirmation and remediation before public
disclosure. Response and fix times depend on severity and maintainer availability.