# Security Policy
## Supported Versions
As Zond is currently in early development, we only provide security updates for the latest version on the `main` branch.
| latest | :white_check_mark: |
| < 0.3.5 | :x: |
## Reporting a Vulnerability
We take the security of Zond seriously. If you believe you have found a security vulnerability, please report it privately to us.
**Please do not open a public GitHub issue for security reports.**
Instead, send a detailed report to: **security@zond.rs**
### What to include:
- A description of the vulnerability.
- Steps to reproduce the issue (including any relevant `zond` commands).
- Potential impact if exploited.
### Our Commitment:
Zond is currently a **best-effort hobby project**. While we do not have a formal full-time security team, we commit to:
- Acknowledging your report within **7 days**.
- Providing a timeline for a fix once the vulnerability is confirmed.
- Crediting you for the discovery (if desired) in our release notes/hall of fame.
## Scope
The security policy applies to all code within this repository, including:
- `zond-engine`
- `zond-cli`
- Plugins and Protocol implementations
We currently do not offer financial bounties, but we deeply appreciate the time and effort researchers put into making Zond more secure.