# Security Policy
Rulewright is free and open source under the [MIT License](LICENSE), so you can read the code yourself. Security issues are best reported privately, before they go public.
## Supported versions
Rulewright supports the latest published release and `main`. Older releases are not patched.
## Reporting a vulnerability
Report through GitHub's private vulnerability reporting: open the [Security tab](https://github.com/wowlabdev/rulewright/security/advisories) and click **Report a vulnerability**. This keeps the report private until there is a fix.
If GitHub is not an option, use the [WoW Lab contact page](https://wowlab.gg/contact). Please do not open a public issue for a security problem.
## What to include
- What the issue is and where it lives.
- How to reproduce it.
- What an attacker could actually do with it.
## What happens next
Every report gets an acknowledgement, an investigation, and status updates while a fix is worked on. Once it is patched, reporters are credited in the advisory if they want.
## Scope
Anything in this repository or the published Rulewright package is fair game. Test against your own repositories and data only; do not test Rulewright by attacking GitHub, crates.io, or anyone else's systems.
## Safe harbor
Good-faith research under this policy will not draw legal action. Report what you find, allow a reasonable chance to fix it, and do not access or destroy other people's data.