# Security Policy
This document describes how to report security vulnerabilities and how they are handled.
This project is open source and maintained by volunteers.
Security handling follows a best-effort model.
---
## Supported Versions
Only the latest released version is actively supported, unless stated otherwise.
Older versions may not receive security fixes.
---
## Reporting a Vulnerability
If you believe you have found a security vulnerability, **do not disclose it publicly**.
Please report it privately using one of the following methods:
- Email: mailto:t@canmi.icu
- GitHub Security Advisory (preferred if available)
Do **not** open public issues, pull requests, or discussions to report security problems.
---
## Required Information
To help us evaluate the report, please include at least:
- A clear description of the vulnerability
- At least one **affected version** that can be reproduced
- If possible, a **version range**
- Reproduction steps or proof-of-concept
Incomplete reports may be deprioritized.
---
## Response Expectations
- This project is maintained without guaranteed compensation.
- There is **no obligation** to provide immediate responses or guaranteed fixes.
- Most vulnerabilities are addressed because we want the project to be better, not because of contractual duty.
We typically review security reports within **24 hours**, but this is **not guaranteed**.
If you receive no response after **72 hours**, you may try another reporting channel or send a reminder.
---
## Fixes and Disclosure
- Confirmed vulnerabilities may only be disclosed **after a fixed version is released**.
- Coordinated disclosure is required.
- Maintainers decide if and when disclosure is appropriate.
---
## Good-Faith Testing
Good-faith security research is allowed under the following conditions:
- No intentional harm
- No data destruction or data exfiltration
- No service disruption
- No abuse of infrastructure
If our open-source software is deployed on internal or public servers and a vulnerability exists, limited testing is acceptable.
Actions commonly understood as malicious or unethical are **not** permitted.
---
## Recognition
If you successfully identify and help fix a security issue, you may be credited or invited to become a maintainer.
This is discretionary.
---
## Authority
Maintainers have final authority over:
- Vulnerability validation
- Severity assessment
- Fix prioritization
- Disclosure timing