# Security Policy

Please report vulnerabilities privately through [GitHub's private vulnerability reporting](https://github.com/hardwood-hq/hardwood/security/advisories/new), not as a public issue. Include:

- the affected version,
- where the problem is: which module (e.g. `hardwood-core`, `hardwood-s3`), or the CLI binary or Docker image,
- how to reproduce it, ideally with a Parquet file that triggers it,
- what an attacker gains.

Security fixes generally go into the next release from `main`. There is no commitment to fix earlier releases.