# Security Policy
## Reporting a vulnerability
Do not open public GitHub issues for security concerns.
Instead, [report a vulnerability on GitHub](https://github.com/firezone/sanstun/security/advisories/new).
This will be visible to the maintainers but not the general public.
## How disclosure is handled
We use coordinated disclosure.
We work privately with you to validate and fix the issue before public disclosure.
Once a fix is available for supported versions, we publish a security advisory on this repository.
## Out of scope
- Social engineering or phishing attacks
- Physical attacks
- Denial-of-service attacks
- Reports produced solely by automated scanners without a demonstrated, exploitable impact
- Third-party services and dependencies not maintained by Firezone
## Supported versions
We support the latest released version of `sanstun`.
Security fixes are delivered in a new release.
We do not backport patches to older versions.