# Security policy
## Supported versions
Until the first stable release, security fixes are provided for the latest
published `0.x` version only.
## Reporting a vulnerability
Do not open a public issue for a suspected vulnerability. Email
`support@reqkey.com` with:
- the affected SDK version and enabled Cargo features;
- a minimal reproduction or affected code path;
- the expected security impact;
- any suggested mitigation.
Please omit live project credentials and consumer API keys. ReqKey will
acknowledge the report, investigate it, and coordinate disclosure and a fixed
release where applicable.
## Credential handling
Project keys must remain in server-side environment/secrets storage. The SDK's
middleware failure events intentionally exclude project keys, consumer keys,
headers, query parameters, and bodies. Analytics header/query/body capture is
opt-in and performs configured redaction, but applications remain responsible
for their own data-classification requirements.