# Security policy

## Supported versions

Only the latest release gets security fixes. A fix ships as a new release and
is not backported, so upgrading is how you get it. Past fixes are listed under
[Security advisories](https://github.com/jarrodruggiero/stocktake/security/advisories).

## Reporting a vulnerability

Please report it privately, not in a public issue: use **Report a
vulnerability** on the
[Security tab](https://github.com/jarrodruggiero/stocktake/security/advisories/new).

What happens next:

- I reply in the report, and work out the fix with you there.
- The fix is written in a private fork, so nothing public describes the problem
  before a fixed release exists.
- When that release is out, I publish the advisory and credit you, unless you
  would rather not be named.

Please give me a reasonable window to fix it before disclosing it anywhere
else.

## What counts

The [security model](https://jarrodruggiero.github.io/stocktake/about/security/)
says what Stocktake protects and what it deliberately does not. Please check it
first: something it documents as out of scope is not a vulnerability.