# Security Policy

## Supported versions

| Version | Supported |
| ------- | --------- |
| 1.x     | Yes       |
| < 1.0   | No        |

Security fixes are applied to the latest `1.x` release. Always run the newest release before
reporting an issue.

## Reporting a vulnerability

Do **not** open a public issue for a security vulnerability. Report it privately through GitHub
Security Advisories:

<https://github.com/ikhsanddy/pixies/security/advisories/new>

Please include:

- Pixies version and installation method (binary, Docker, source)
- A description of the vulnerability and its impact
- Steps to reproduce or a proof of concept
- Any suggested fix or mitigation

You will receive a response in the advisory thread. Once the report is confirmed, a fix is
prepared and a GitHub Security Advisory is published with credit unless you ask to stay
anonymous.

## Scope

Reports about this repository's code are in scope. Vulnerabilities in third-party providers
(Ookla, LibreSpeed, Cloudflare) or in dependencies should be reported to those projects.