# Security Policy
## Supported Versions
Security fixes are applied to the latest released `0.1.x` line. Because this
crate is pre-1.0, only the most recent minor series receives security updates.
| 0.1.x | ✅ |
| < 0.1.0 | ❌ |
## Reporting a Vulnerability
If you discover a security vulnerability in `vfa-tui`, please report it
privately so it can be addressed before public disclosure.
- **Contact:** open a [GitHub Security Advisory](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic/security/advisories/new)
for the repository, or email the maintainers at
`15792229+VincentChuWaiChow@users.noreply.github.com` with the subject line `vfa-tui security`.
- **Do not** open a public issue for undisclosed vulnerabilities.
### What to include
- A description of the vulnerability and its impact
- Steps to reproduce (proof-of-concept where possible)
- Affected version(s) and platform(s)
### Response timeline
| Acknowledgement | within 3 business days |
| Initial assessment | within 7 business days |
| Fix or mitigation | depends on severity; coordinated with reporter |
| Public disclosure | after a fix is released, by mutual agreement |
We aim to keep reporters informed throughout the process and will credit
reporters in the release notes unless anonymity is requested.