# Security Policy

## Supported Versions

| Version        | Supported          |
| -------------- | ------------------ |
| latest release | :white_check_mark: |

Only the latest release receives security fixes, so please confirm the issue reproduces on it before reporting.

## Reporting a Vulnerability

**Do not** open a public issue, discussion, or pull request for a security vulnerability.

Report it privately through [GitHub Security Advisories](https://github.com/janhq/jan/security/advisories/new) (the **Report a vulnerability** button on the [Security tab](https://github.com/janhq/jan/security)). This keeps the report, the discussion, and the fix in one private place, and lets us request a CVE and credit you when the advisory is published.

If you can't use GitHub, email [security@jan.ai](mailto:security@jan.ai) instead. We will open the advisory for you, so you are still credited; include your GitHub username if you want the credit linked to it.

Please include:

- The affected version and platform
- Steps to reproduce, or a proof of concept
- The impact as you understand it

Allow us reasonable time to fix the issue before any public disclosure.

## What to Expect

- We will acknowledge your report within 3 business days
- We will give you an estimated timeline for a fix
- We will notify you when the vulnerability is fixed
- We credit researchers who report valid vulnerabilities, unless you prefer to stay anonymous