# Security Policy
## Reporting a Vulnerability
Please report suspected vulnerabilities **privately** via GitHub's
[Private Vulnerability Reporting](https://github.com/3ncr/tokencrypt-rust/security/advisories/new)
on the Security tab. Do not file public issues for security-sensitive reports.
We aim to acknowledge reports within 5 business days and to ship a fix or
documented mitigation within 30 days for confirmed vulnerabilities, depending
on severity and complexity.
## Supported Versions
The [3ncr.org v1 envelope](https://3ncr.org/1/) is the only supported format.
Security fixes land on the latest release of the `v1.x` line.
| 1.x | Yes |
| < 1.0 | No |