# Security Policy

## Reporting A Vulnerability

Do not open a public issue for a suspected vulnerability or include credentials, tokens, Subscriber data, email content, or private workspace details in a report.

Email `security@mailrith.com` with a concise description, affected package and version, reproduction steps, and the impact you observed. Use synthetic data and redact all secrets. Mailrith will acknowledge the report and coordinate a safe fix and disclosure timeline.

## Supported Versions

Only the latest stable version listed in `packages/agent-release-manifest.json` is supported. Security fixes will not intentionally weaken workspace isolation, permission checks, resource safeguards, or Subscriber protections.