# Security Policy

We take the security of World of ClaudeCraft seriously, and we appreciate the work
of everyone who helps keep players and self-hosters safe.

## Reporting a vulnerability

**Please do not report security vulnerabilities through public GitHub issues,
pull requests, or Discord.** Public disclosure before a fix is available puts
players and people running their own servers at risk.

Instead, report privately using one of these channels:

- **GitHub private advisory (preferred).** Go to the
  [Security tab](https://github.com/levy-street/world-of-claudecraft/security/advisories/new)
  and open a draft advisory. This keeps the report private between you and the
  maintainers until a fix is ready.
- **Discord.** If you can't use GitHub advisories, send a private message to a
  member of the **Levy St**, **Admin**, or **Devs** group on the
  [community Discord](https://discord.gg/GjhnUsBtw) and ask for a secure way to
  share the details.

Please include as much as you can:

- What the issue is and the kind of impact you think it has.
- Steps to reproduce, or a proof of concept.
- Affected area (offline client, online server, authentication, moderation,
  database, and so on) and any relevant versions or commits.

## What to expect

- We'll acknowledge your report as quickly as we can, normally within a few days.
- We'll keep you updated as we investigate and work on a fix.
- Once a fix is released, we're glad to credit you for the discovery, unless you'd
  prefer to stay anonymous.

We ask that you give us a reasonable amount of time to release a fix before any
public disclosure, and that you avoid accessing or modifying other people's data,
degrading the service, or running tests against the live multiplayer servers
without permission.

## Supported versions

World of ClaudeCraft is under active development and is currently pre-1.0. Security
fixes land on the `main` branch and ship in the next release, so the most recent
release and the current `main` are the supported targets. If you run a self-hosted
server, please keep it up to date.

Thank you for helping keep the community safe.