# Security Policy
## Supported Versions
Security fixes are applied to the latest released version. The `0.1.x` line is
the initial supported release line.
## Reporting a Vulnerability
Please do not open a public issue for an undisclosed vulnerability.
Use GitHub's private vulnerability reporting for the
[Agentree repository](https://github.com/ydah/agentree/security/advisories/new).
Include the affected version or commit, reproduction steps, impact, and any
suggested mitigation. If private reporting is unavailable, contact the
repository maintainers privately through GitHub before disclosing the issue.
Agentree is a cooperative guardrail, not an operating-system sandbox. Reports
should distinguish a bypass of an Agentree policy from behavior explicitly
outside the documented security boundary in [docs/security.md](docs/security.md).