# Security Policy

## Supported Versions

Security fixes are backported to the **latest minor release of the current major
version** and the **latest minor release of the immediately preceding major version**.
Older major/minor streams do not receive security patches.

| Version stream                     | Supported          |
|-------------------------------------|--------------------|
| Latest minor of the current major  | :white_check_mark: |
| Latest minor of the previous major | :white_check_mark: |
| Anything older                     | :x:                |

## Reporting a Vulnerability

If you think you have found a security vulnerability in springdoc-openapi, please *DO NOT*
disclose it publicly, and don't report it in a GitHub issue, until it has been fixed.

Report it through the [Tidelift security contact](https://tidelift.com/security).
Tidelift will coordinate the fix and disclosure.