# Security Policy

## Supported versions

Security fixes are released for the latest major version of each package published from this repository. Older major versions are not patched, so please upgrade to receive fixes.

## Reporting a vulnerability

**Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.**

Report them privately through [GitHub's private vulnerability reporting](https://github.com/JacobLey/leyman/security/advisories/new).

Please include as much of the following as you can:

- The affected package(s) and version(s)
- The type of issue (for example prototype pollution, ReDoS or a cryptographic weakness)
- Steps to reproduce, ideally with a minimal proof of concept
- The impact, and how an attacker might exploit it

## What to expect

- You should receive an acknowledgement within 7 days.
- Once the issue is confirmed, a fix will be developed privately and released as a patch to the affected packages.
- A [GitHub security advisory](https://github.com/JacobLey/leyman/security/advisories) will be published once a fix is available. You will be credited unless you prefer not to be.

Please give us a reasonable amount of time to release a fix before disclosing the issue publicly.