# Security Policy

Security and stability are paramount for AG2.

Learn more below. 👇

## Versions

The latest version of AG2 is actively supported.

We strongly encourage you to write tests for your application and regularly update your AG2 version after confirming that your tests pass. This ensures you benefit from the latest features, bug fixes, and **security updates**.

## Reporting a Vulnerability

If you suspect a security issue, even if you are uncertain, please report it promptly. However, **do not create a public issue**.

To responsibly report a security concern, navigate to the Security tab of the repository and click on *"Report a vulnerability"*.

Alternatively, you can send an email to: [support@ag2.ai](mailto:support@ag2.ai).

Ensure your report contains sufficient detail. As with standard issue reports, a minimal, reproducible example expedites issue resolution.

## Response and Disclosure Timeline

We aim to respond to security reports on the following timeline:

- **Acknowledgement:** within **3 business days** of receiving your report.
- **Fix or mitigation:** within **90 days** for confirmed vulnerabilities, coordinated with the reporter where appropriate.

If we cannot meet these targets for a specific issue, we will communicate the reason and a revised timeline to the reporter.

## Safe Harbor for Security Researchers

We support good-faith security research and will not pursue or support legal action against researchers who:

- Make a good-faith effort to avoid privacy violations, data destruction, and service disruption.
- Only interact with accounts and data they own or have explicit permission to access.
- Report vulnerabilities promptly via the channels described above and do not disclose them publicly until we have had a reasonable opportunity to remediate.

Activity conducted consistent with this policy is considered authorized, and we will work with you to understand and resolve issues quickly.

## Public Discussions

Please restrain from publicly discussing potential security vulnerabilities. 🙊

It is advisable to engage in private discussions and seek solutions first to minimize potential impact.

---

Thanks for your help!
