# Security Policy
## Supported versions
This project is still pre-1.0 and under active development. Security fixes, when made, are expected to land on the default branch first rather than through long-lived maintenance branches.
## Reporting a vulnerability
Do not open public GitHub issues for suspected vulnerabilities.
Report security concerns privately to the maintainer through the repository owner profile:
- https://github.com/DiogoRibeiro7
When reporting, include:
- a description of the issue
- affected versions, branches, or commit SHAs
- reproduction steps or proof of concept
- impact assessment if known
You should expect:
- acknowledgement after the report is reviewed
- a request for clarification if reproduction is incomplete
- coordination on disclosure timing when the report is valid
Because this is a statistical computing library, many “security” reports may actually be numerical correctness or denial-of-service style input issues. Those are still worth reporting privately if you believe they could materially affect users.