# Security Policy
## Supported Versions
Security Updates are applied only to the most recent release.
## Reporting a Security Bug
If you think you have discovered a security issue in any of the code, we'd love to hear from you, please report it privately. We will take all security bugs seriously and if confirmed upon investigation we will patch it within a reasonable amount of time and release a public security bulletin discussing the impact and credit the discoverer. **Do not disclose it as a public issue**. This gives us time to work with you to fix the issue before public exposure, reducing the change that the exploit will be used before a patch is released.
The best way to report a security bug and easiest is to disclose it at [security advisory](https://github.com/tectonic-labs/bedrock/security/advisories/new). Please include a description of the flaw and any related information (e.g. reproduction steps, version).