# Security Policy
There are many users using LibOSDP in some capacity in production. If you think
you found a bug that may have security implications, please follow the usual
responsible disclosure protocols. Any issue reported in this channel will be
acknowledged withing 3 business days.
If an issue has been confirmed by a maintainer, we request the reporter to
respect a 90 day embargo period before making the issue public.
## Supported Versions
LibOSDP will support the last 2 [releases][1] for security and bug fixes.
| <= 1.5 | N/A | :x: |
| 2.4.x | 2.4.x | :white_check_mark: |
| latest | master | :white_check_mark: |
## Reporting a Vulnerability
Please send an email to sidcha.dev@gmail.com ([GPG]([2])).
## Security Mailing List
If you are a vendor using LibOSDP in a product (or any production capacity),
please send an email to sidcha.dev@gmail.com to get added to a private mailing
list which will be used to notify about critical incidents such as
vulnerabilities and potential fixes or workarounds before the issue has been made
public.
You can also follow the [security advisories][3] page but this will be updated
only after the issue has been made public.
Note: For very obvious reasons, not everyone can be added to this list. You
should be able to prove that you are indeed using LibOSDP in production.
[1]: https://github.com/goToMain/libosdp/releases
[2]: https://github.com/sidcha.gpg
[3]: https://github.com/goToMain/libosdp/security/advisories