# Security Policy

## Supported versions

Rove does not currently publish a guaranteed security-maintenance window or
backport schedule. Please report vulnerabilities affecting the latest tagged
release or the current `main` branch. Include older affected versions in your
report; maintainers assess backports for each issue.

## Report a vulnerability

Do not put exploit details, a proof of concept, credentials, or sensitive logs
in a public issue or pull request.

1. Check the repository's [Security Advisories](https://github.com/justsomeone-e/RoveLang/security/advisories)
   page. If **Report a vulnerability** is available, submit the report there.
2. If private reporting is unavailable, open a
   [public issue requesting a private security contact](https://github.com/justsomeone-e/RoveLang/issues/new?title=Request%20a%20private%20security%20contact).
   Include only a short request for a confidential channel, without any
   vulnerability details. Share the report after a private channel is arranged.

In the private report, include the affected Rove version or commit, component
and target platform, impact, minimal reproduction, and any conditions needed to
trigger the issue. Remove secrets and personal data from logs and examples.

Maintainers will investigate and coordinate a fix and disclosure as appropriate.
There is no fixed response-time commitment. For non-security defects, use the
regular [issue tracker](https://github.com/justsomeone-e/RoveLang/issues).