# Security Policy

## Reporting a Vulnerability

We take the security of this project seriously. 

* **Primary Channel:** If you discover a sensitive security vulnerability, please [report it privately through GitHub](https://github.com/dannyvfilms/Floppy/security/advisories/new) (sign-in required). Please do not open public GitHub Issues or public Discord threads for security vulnerabilities.
* **Secondary Channel:** For sensitive matters where GitHub Advisories are not feasible, you may Direct Message (DM) the maintainers on our Discord server.

## Urgent Inquiries

For urgent but non-sensitive matters, general questions, and immediate assistance requests, please reach out to our community Discord Channel: [https://discord.gg/uFgha7Kb6n](https://discord.gg/uFgha7Kb6n).

## Contributing Security Fixes

Coordinate sensitive fixes through the private reporting channel before opening a public pull request, which could disclose the vulnerability.

When contributing a security fix, please ensure that your contribution is accompanied by ample testing to prevent future regressions. Follow the guidelines outlined in our [CONTRIBUTING.md](CONTRIBUTING.md) guide for testing and development setup.

## Release and Response Expectations

Floppy does not currently publish a security support window or an older-release backport policy. Do not assume older tags receive security fixes. Check the [release notes](https://github.com/dannyvfilms/Floppy/releases) and the deployed image's source revision when assessing whether a fix is installed; a source change alone does not update a published image.

No response-time guarantee is published. Include the affected version or image digest, reproduction steps, and impact in a private report. If GitHub reporting is unavailable, use the maintainer DM fallback above.