# Security Policy

## Supported Versions

Security fixes are applied to the latest released version of `trustcheck`.

If you believe an issue affects an older release, please report it anyway and include the affected version so impact can be evaluated.

## Reporting a Vulnerability

Report suspected vulnerabilities through GitHub's private vulnerability reporting form:

- [Open a private security advisory](https://github.com/Halfblood-Prince/trustcheck/security/advisories/new)

Do not open a public issue for a vulnerability before coordinated disclosure.
Use [GitHub Issues](https://github.com/Halfblood-Prince/trustcheck/issues) only
for non-sensitive bugs, documentation problems, and feature requests.

When reporting, include:

- a clear description of the issue
- reproduction steps or a proof of concept, if available
- the affected `trustcheck` version
- any suggested mitigation or workaround

You can expect an initial acknowledgment within 7 business days.

After triage, the maintainer will aim to:

- confirm whether the report is reproducible
- assess severity and affected versions
- prepare a fix or mitigation when appropriate
- coordinate a responsible disclosure timeline
