# Security Policy

## Supported Versions

We release security updates for actively maintained versions of NitroStack.

| Version | Supported |
| :------ | :-------- |
| latest  | :white_check_mark: |
| older   | :x: |

If you are using an older version, please upgrade to the latest release before
reporting a vulnerability.

## Reporting a Vulnerability

Please do **not** report security vulnerabilities through public GitHub issues
or discussions.

Instead, report vulnerabilities privately to:

- **Email:** [oss@nitrostack.ai](mailto:oss@nitrostack.ai)
- **Subject line:** `Security vulnerability report: <short title>`

To help us triage quickly, include:

- A clear description of the issue and potential impact
- Affected package(s) and version(s)
- Steps to reproduce or proof-of-concept
- Any suggested mitigations or fixes

## Response Process

After receiving your report, we will:

1. Acknowledge receipt within **3 business days**
2. Investigate and validate the issue
3. Share status updates as we progress
4. Coordinate a fix and responsible disclosure timeline

If the report is accepted, we will publish a security advisory and release a
patch as quickly as possible.

## Responsible Disclosure

Please give us a reasonable amount of time to investigate and remediate before
public disclosure. We appreciate and value coordinated disclosure.

Thank you for helping keep NitroStack and its users safe.