# Security Policy
**ghost-core** is an open-source component of [Ryu](https://ryuhq.com), maintained by
A Major Pte. Ltd.
## Reporting a vulnerability
Please report security vulnerabilities **privately** — do not open a public issue or pull request.
- Email **security@ryuhq.com** with details and reproduction steps, or
- Use GitHub's private vulnerability reporting ("Security" → "Report a vulnerability") on this
repository.
We aim to acknowledge reports within 3 business days and to share a remediation timeline after
triage. Please give us a reasonable window to ship a fix before public disclosure; we're glad to
credit you once a fix is released.
## Supported versions
Security fixes target the latest released version on `main`. Older versions are not maintained.