# Security Policy

The Vexa Core maintainers take the security of the project seriously.

## Reporting a vulnerability

**Please do not report security vulnerabilities through public GitHub issues,
discussions, or pull requests.**

Instead, report them privately by email to **dmitry@vexa.ai**. You may copy
**help@finos.org**. Please include:

- a description of the vulnerability and its impact,
- steps to reproduce or a proof of concept,
- the affected versions / components, and
- any suggested mitigation.

We will acknowledge your report within 5 business days and keep you informed as we
investigate and remediate. We follow a coordinated-disclosure process and will
agree a public-disclosure timeline with you.

## Supported versions

Vexa Core is under active development. Security fixes are applied to the `main`
branch and the latest release line. Please test against `main` before reporting.

## OSPS Baseline

The project tracks the [OSPS Baseline](https://baseline.openssf.org/) (target: Maturity Level 2, a
FINOS Incubation commitment). Dated self-assessment results live in
[`security/osps-baseline/`](security/osps-baseline/) — latest: **2026-07-02, 28 passed · 0 failed**.