# Security Policy
## Supported Versions
| 2.x | :white_check_mark: |
| < 2.0 | :x: |
## Reporting a Vulnerability
If you discover a security vulnerability in mp3rgain, please report it responsibly.
**Do NOT open a public GitHub issue for security vulnerabilities.**
Instead, please use [GitHub's private vulnerability reporting](https://github.com/M-Igashi/mp3rgain/security/advisories/new) to submit your report.
### What to include
- Description of the vulnerability
- Steps to reproduce
- Affected version(s)
- Potential impact
### Response timeline
- **Acknowledgment**: within 7 days
- **Fix or mitigation**: best effort, typically within 30 days
## Security Measures
This project uses the following automated security tools:
- **Dependabot** — dependency updates and vulnerability alerts
- **CodeQL** — static analysis for Rust and GitHub Actions
- **Secret scanning** — prevents accidental credential commits