# Security Policy

## Supported Versions

| Version            | Supported          |
|--------------------|--------------------|
| Latest 3.x minor   | :white_check_mark: |
| Older 3.x minors   | :x:                |
| 2.x.x              | :x:                |
| 1.x.x              | :x:                |
| < 1.0              | :x:                |

Security fixes are released as patch versions of the latest 3.x minor.

## Reporting a Vulnerability

Report suspected security vulnerabilities through
[GitHub's private vulnerability reporting](https://github.com/vendurehq/vendure/security/advisories/new).
This allows the Vendure maintainers to discuss and resolve the report securely before
any details are made public.

Please do not report security vulnerabilities through public GitHub issues or email.