# Security Policy > This is the default security policy for all `hyperpolymath` projects. A > repository may override it with its own `SECURITY.md`. ## Reporting a Vulnerability **Please do not report security vulnerabilities through public issues, pull requests, or discussions.** Instead, use GitHub's private vulnerability reporting: 1. Go to the **Security** tab of the affected repository. 2. Click **Report a vulnerability**. 3. Fill out the advisory form with as much detail as you can — affected version, reproduction steps, and impact. If private reporting is unavailable on a particular repository, email **j.d.a.jewell@open.ac.uk** with the details. ## What to Expect - **Acknowledgement** within 48 hours. - An initial assessment and severity triage shortly after. - Coordinated disclosure: we will agree a timeline with you and credit you in the advisory unless you prefer to remain anonymous. ## Supported Versions Unless a repository states otherwise, security fixes target the latest `main` and the most recent tagged release. | Version | Supported | | ---------------- | ------------------ | | latest `main` | :white_check_mark: | | latest release | :white_check_mark: | | older | :x: | ## Scope This policy covers vulnerabilities in the project's own code. For vulnerabilities in third-party dependencies, please open a public **🛡️ Dependency / advisory** issue referencing the upstream advisory (CVE / GHSA / RUSTSEC) instead — those are already public.