# Security policy
Report vulnerabilities through
[GitHub's private vulnerability form](https://github.com/austin-starks/chrono-ta/security/advisories/new).
Do not open a public issue for an unfixed vulnerability.
Include the affected version or commit, a minimal reproduction, impact, and any
conditions required to reach the problem. Remove credentials, private market
data, and proprietary strategy details.
Incorrect indicator output without a security impact is an ordinary bug report.
A report is security-sensitive when it can cause memory unsafety, denial of
service from untrusted input, unauthorized data exposure, dependency compromise,
or another exploit beyond a wrong calculation.
Security fixes target the current release line. Older releases receive fixes
only when the maintainer says so in the advisory.