# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| latest  | :white_check_mark: |

Only the latest released version receives security updates.

## Reporting a Vulnerability

If you discover a security vulnerability in SynaptoMind, please report it responsibly.

**Do not open a public GitHub issue for security vulnerabilities.**

Instead, send an email to **zumik3@gmail.com** with:

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

## Response Timeline

- **Acknowledgment**: within 48 hours
- **Initial assessment**: within 1 week
- **Fix or mitigation**: depends on severity, typically within 2 weeks for critical issues

## Scope

This policy applies to the SynaptoMind server, MCP tools, and HTTP API. It does not cover third-party dependencies — report those to their respective maintainers.