# Security Policy

## Reporting a vulnerability

Please don't report security vulnerabilities in public issues, discussions or pull requests.

Instead, report them privately through GitHub. Go to the [Security tab](https://github.com/jesseduffield/lazygit/security) of this repository and click "Report a vulnerability". Only the maintainers can see your report.

Please include:

- the lazygit version (the output of `lazygit --version`) and your operating system
- the steps to reproduce the problem, ideally as a script that sets up a repository
- what an attacker can achieve with it

## What happens next

Lazygit is maintained by volunteers in their spare time. We can't promise a fixed response time, but we'll get back to you as soon as we can.

If we confirm the vulnerability, we fix it in private and release a new version. Then we publish a security advisory, request a CVE for it through GitHub, and credit you in the advisory unless you prefer not to be named.

## Supported versions

We only fix security vulnerabilities in the latest release. Please check whether the problem still exists there before you report it.