# Security policy

## Supported versions

Angular Native is in alpha. Only the latest published `0.x` release of each `@ng-native/*` package
is supported; there are no older release lines to backport a fix to.

## Reporting a vulnerability

Report a vulnerability privately through GitHub's
[private security advisories](https://github.com/ng-native/ng-native/security/advisories/new)
("Report a vulnerability" on the repository's Security tab). Do not open a public issue for a
security report.

Include what you'd include in any bug report: the package and version affected, a description of
the issue, and, if you have one, a minimal reproduction.

## What to expect

This is a small, alpha-stage project maintained outside of working hours, so there's no formal SLA.
Expect an acknowledgement within a few days, and a fix or a public response once the report has
been triaged. If the issue is confirmed, a fix will go out in the next release and the
advisory will be credited to you unless you ask otherwise.