# Security Policy

## Supported Versions

This project is early-stage. Security review and fixes are prioritized for:

- the default branch
- the latest public release, once releases exist

Older snapshots may not receive fixes.

## Reporting a Vulnerability

Please do not report security vulnerabilities in public issues or pull requests.

Use a private reporting path instead:

1. Use GitHub Private Vulnerability Reporting for `PSDN-AI/SONAR-OSS`, if it is enabled.
2. If private reporting is not available yet, contact the repository owner through GitHub and request a
   private disclosure path.

When possible, include:

- the affected area
- a short description of impact
- reproduction steps or proof of concept
- any known mitigations or workarounds

## What to Expect

Maintainers will aim to acknowledge reports within 5 business days, triage the issue, and coordinate next
steps with the reporter.

Please avoid public disclosure until maintainers have had a reasonable chance to investigate and prepare a
fix or mitigation.
