# Security Policy

## Supported versions

We support the latest published version and the `main` branch. Please update to the newest release before reporting issues.

## Reporting a vulnerability

- Email: [simon_he@outlook.com](mailto:simon_he@outlook.com)
- Please include reproduction steps, affected version, and impact. If possible, attach a minimal repro (the test page can generate shareable links: https://markstream-vue.simonhe.me/test).
- Do not open public issues for potential vulnerabilities until we coordinate a fix and disclosure timeline.

## Response expectations

You should receive an acknowledgement within 72 hours. Once confirmed, we will work with you on a fix and coordinated disclosure.