# Security Policy

## Reporting a Vulnerability

Please report security vulnerabilities through [GitHub's private vulnerability reporting](https://github.com/frontman-ai/frontman/security/advisories/new).

**Do not** open a public issue for security vulnerabilities.

## Supported Versions

| Version | Supported |
|---------|-----------|
| Latest  | Yes       |

## Scope

**In scope:**
- Server (`apps/frontman_server/`)
- Client libraries (`libs/`)
- Protocol layer (`libs/frontman-protocol/`)

**Out of scope:**
- Marketing website (`apps/marketing/`)
- Infrastructure configs (`infra/`)

## Response Timeline

- **Acknowledgment:** Within 48 hours of report
- **Fix target:** Within 90 days of confirmation
- **Disclosure:** Coordinated disclosure after a fix is available — no public disclosure before then