# Security Policy

## Supported versions

Security fixes ship in the latest release. Older versions don't get backported fixes, so update to
the latest release to receive them.

## Reporting a vulnerability

Don't open a public GitHub issue for a vulnerability that isn't fixed yet. Report it privately
through GitHub's security advisories:

https://github.com/EJM-Digital/Weir/security/advisories/new

Include:

- the affected area and the Weir version
- steps to reproduce
- what an attacker could do with it
- any proof-of-concept details needed to reproduce it

## Response expectations

- Reports are acknowledged within 7 days.
- Confirmed vulnerabilities are fixed in a new release and disclosed once that release is available.

## Hardening baseline

The release hardening checklist is in [`docs/security-hardening.md`](docs/security-hardening.md).