# Security Policy

## Reporting a Vulnerability

**Do not open a public GitHub issue for security vulnerabilities.**

Send an email to **[brightio.code@gmail.com](mailto:brightio.code@gmail.com)** with the details of the issue. We'll get back to you within 72 hours. If the issue is confirmed, we'll ask you to open a private GitHub security advisory so we can work on a fix together.


## What to Include

- Description of the vulnerability and its potential impact
- Steps to reproduce
- Affected versions or environments
- Proof of concept, logs, or screenshots if available
- Suggested fix

## What to Expect

Once we receive your report, we'll acknowledge it, investigate, and keep you in the loop on progress. If a fix is issued, we're happy to credit you in the release notes, just mention your preference when you write in.

Please don't disclose the vulnerability publicly until a fix is out or we've agreed on a disclosure date.

## Supported Versions

Only the latest release receives security updates.

| Version               | Supported |
| --------------------- | --------- |
| Latest release        | ✅        |
| All previous releases | ❌        |

## Other Issues

For bugs, feature requests, and everything else, open an issue on the [GitHub issue tracker](https://github.com/brightio/penelope/issues).
