# 📄 Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in **Godot Launcher**, please **do not** open a public issue.

Instead, report it responsibly by emailing:

📧 `security@godotlauncher.org`

Please include:

- A detailed description of the vulnerability.
- Steps to reproduce the issue.
- Potential impact.
- Any suggested mitigation or patch (optional but appreciated).

We aim to respond within **72 hours** and provide a fix within **7–14 days**, depending on severity.

---

## Supported Versions

| Version        | Supported          |
|----------------|--------------------|
| Latest release | ✅                 |
| Older versions | ❌ (not maintained) |

We only patch the **latest stable release**.

---

## Scope

This policy applies to:

- The Godot Launcher application
- Godot version manager code
- Editor settings handling logic
- Update system
- All scripts in the [main GitHub repository](https://github.com/godotlauncher/launcher)

It does **not** apply to:
- External tools like Git or VSCode
- The Godot engine itself (report those to [Godot's issue tracker](https://github.com/godotengine/godot/issues))

---

## Disclosure Process

1. Vulnerability reported privately
2. Acknowledgement from maintainer
3. Investigation and patch creation
4. Coordinated disclosure (if needed)
5. Public security advisory on GitHub

---

## Hall of Fame

We may credit responsible disclosures in our release notes or a `SECURITY_CREDITS.md` file, if permission is granted.