# Security Policy
## Reporting a vulnerability
If you find a security issue in kagami, please **do not open a public issue**. Report it through
[GitHub's private vulnerability reporting](https://github.com/zunda-inc/kagami/security/advisories/new)
instead (the "Security" tab of this repository, then "Report a vulnerability").
- Please include the steps to reproduce, the affected versions and the impact you expect.
- We will get back to you once we have looked into the report and decided how to address it.
- Please keep the details private until a fix has been released.
Advisories that kagami misses or matches wrongly, such as a version range it cannot read, are not
vulnerabilities in kagami itself; please open a regular issue for them. Vulnerabilities in the
software that kagami checks should be reported to that project.
## Supported versions
Only the latest release receives security fixes.