# Security policy

## Supported versions

The following versions of [Project name] receive security updates:

| Version | Supported |
|---|---|
| [3.x] | Yes |
| [2.4.x] | Security fixes only, until [YYYY-MM-DD] |
| [< 2.4] | No |

If you use an unsupported version, upgrade to a supported version before reporting.

## Reporting a vulnerability

Do not report security vulnerabilities through public issues, discussions, or pull requests.

Report vulnerabilities privately using one of these options:

- **GitHub private vulnerability reporting:** Open the [Security and quality tab](https://github.com/[owner]/[repository]/security) of this repository and select **Report a vulnerability**. [Delete this option if private vulnerability reporting is not enabled.]
- **Email:** [security@example.com]. [Optional: Encrypt your message with our PGP key: link to key, fingerprint.]

## What to include

To help us assess the report quickly, include as much of the following as you can:

- The type of vulnerability, for example cross-site scripting, SQL injection, or authentication bypass
- The affected version, component, and file paths
- Step-by-step instructions to reproduce the issue
- Proof-of-concept code or a request that demonstrates it, if available
- The impact, including how an attacker might exploit it
- Any special configuration required to reproduce it
- How you would like to be credited, if at all

## What to expect

These are our targets. Actual times may vary.

- **Acknowledgment:** within [number] business days of your report
- **Initial assessment:** within [number] business days, including whether we accept the report
- **Status updates:** at least every [number] days until the issue is resolved
- **Fix and release:** [Describe how fixes are prioritized, for example by severity]

If we decline the report, we will explain why.

## Disclosure policy

We follow coordinated disclosure:

1. We confirm the vulnerability and determine the affected versions.
2. We prepare fixes for all supported versions.
3. We release the fixes and publish a security advisory.
4. We credit the reporter in the advisory, unless they ask to remain anonymous.

Please keep the vulnerability confidential until we publish a fix, or until [number] days after your report, whichever comes first. If you need a different timeline, tell us in your report.

## Scope

**In scope:** [Repositories, packages, services, or domains covered by this policy]

**Out of scope:** [For example: issues in third-party dependencies that should be reported upstream, denial of service through excessive traffic, social engineering, findings from automated scanners without a demonstrated impact]

## Contact

For questions about this policy that are not vulnerability reports, contact [email or link].