# Security Policy

## Supported Versions

LinkShelf is pre-1.0 and does not maintain long-lived release branches. Only the latest release is supported with
security fixes; please upgrade before reporting an issue that's already fixed on `main`.

| Version      | Supported          |
| ------------ | ------------------ |
| Latest release | :white_check_mark: |
| Older releases | :x:                |

## Reporting a Vulnerability

Please report security vulnerabilities privately by emailing **security@mattiamueggler.ch** instead of opening a
public GitHub issue.

Include what you can: the affected component/version, steps to reproduce, and the potential impact.

- We'll keep you updated as the report is investigated, and let you know if we need more information.
- If the vulnerability is accepted, we'll work on a fix and coordinate a disclosure timeline with you before it's
  made public.
- If it's declined (e.g. not reproducible, or out of scope), we'll explain why.