# Security Policy
## Supported versions
`yomitoki` is pre-1.0 (`0.1.0-alpha.1`). Only the latest published version
is supported — there are no backported security fixes to older versions.
## Reporting a vulnerability
Please report security issues privately via
[GitHub Security Advisories](https://github.com/kent-tokyo/yomitoki/security/advisories/new)
rather than a public issue. This includes panics, unbounded resource
consumption, or other denial-of-service behavior triggerable by untrusted
SMILES/SDF input passed to `analyze`, `analyze_smiles`, `analyze_batch`, or
the `yomitoki` CLI.
You should get an initial response within a few days.
## Scope
`yomitoki` itself does not parse or perceive molecular structure — it
delegates entirely to [chematic](https://github.com/kent-tokyo/chematic).
If you've found a way to trigger a panic or crash with untrusted input and
you're not sure whether the bug is in `yomitoki`'s own logic or in
`chematic`, report it here; we'll redirect to
[chematic's own issue tracker](https://github.com/kent-tokyo/chematic/issues)
if it turns out to be upstream.