# Security policy

NectarLink handles sensitive data such as notifications, messages, one-time
codes and files, so security reports are taken seriously.

## Reporting a vulnerability

**Please don't open a public issue for security problems.**

Report privately through GitHub's private vulnerability reporting: open the
repository's **Security** tab and choose **Report a vulnerability**.

Please include:

- what the issue is and its impact,
- steps to reproduce, or a proof of concept,
- the affected versions (desktop app, Android app, Windows and Android
  versions).

## What to expect

- An acknowledgement within 7 days.
- Updates as the issue is investigated and fixed.
- Credit in the release notes once a fix ships, if you'd like it.

Please give us a reasonable amount of time to release a fix before disclosing
the issue publicly.

## Supported versions

Security fixes go into the latest release. Both apps update themselves from
GitHub Releases, so keeping **Check for updates** on is the way to get them.