# Security Policy
## Supported versions
Until releases exist, security fixes support the current `main` branch only.
## Reporting a vulnerability
Do not file a public issue. Use this repository's [Report a vulnerability](https://github.com/referential-ai/platonic-core/security/advisories/new) form. Reports are confidential.
`platonic-core` owns pure harness primitives: run state, typed context, tool and policy boundaries, events, and replay. Application and runtime containment belongs to [`plato-agent`](https://github.com/referential-ai/plato-agent/security/advisories/new), including providers, tools, stores, daemons, gateways, credentials, and sandboxing.