We release security updates for the following versions:

Specific supported versions will be updated as we release and EOL branches.

We take security seriously. If you believe you have found a security vulnerability, please report it responsibly.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them by one of the following means:

1. Preferred: Open a private security advisory on GitHub. This allows maintainers to discuss and fix the issue in private before disclosure.
2. Alternative: Email the maintainers at contact@superphenix.net.

Please include:

• A description of the vulnerability and the affected components
• Steps to reproduce
• Potential impact (e.g., privilege escalation, data exposure)
• Any suggested fix or mitigation, if you have one

We will acknowledge your report as soon as possible and will work with you to understand and address the issue. We may ask for additional information or clarification.

• Acknowledgment: We will confirm receipt of your report.
• Assessment: We will assess the report and determine impact and severity.
• Fix and release: We will work on a fix and coordinate with you on disclosure timing where appropriate.
• Credit: With your permission, we will credit you in the security advisory and release notes.

We ask that you allow a reasonable time for a fix before making any public disclosure. We are committed to transparent handling of security issues in line with responsible disclosure practices.

• Issues in third-party dependencies should be reported to the respective project; we will track and integrate upstream fixes.
• General configuration or hardening advice (we welcome those as documentation or discussion issues).