# Security Policy

## Supported versions

We release security fixes for the latest stable version and the `master` branch. If you are running an older version, upgrading is the fastest path to a fix.

| Version | Supported          |
| ------- | ------------------ |
| Latest stable | :white_check_mark: |
| master  | :white_check_mark: |
| Older releases | :x:                |

## Reporting a vulnerability

Please do **not** open a public issue for security problems.

Instead, use one of these channels:

1. **GitHub Private Security Advisory** — [Open a draft advisory](https://github.com/kapicorp/kapitan/security/advisories/new) (preferred).
2. **Contact a maintainer directly** — See [MAINTAINERS.md](MAINTAINERS.md) for current maintainers.

Include as much detail as possible:
- Affected versions
- Steps to reproduce
- Potential impact
- Suggested fix (if you have one)

## Response process

- We aim to acknowledge reports within 5 business days.
- We will investigate and provide an initial assessment within 15 business days.
- Once a fix is ready, we will coordinate disclosure and publish a security advisory.
- We credit reporters unless they prefer to remain anonymous.

## Disclosure policy

We follow a coordinated disclosure model. We ask reporters to give us reasonable time to release a fix before publicly discussing the issue.
