Security updates are provided for the two most recently released minor release lines. As long as fewer than two minor release lines have been released, all available minor release lines are supported.

We take security seriously. If you discover a security vulnerability, please report it responsibly.

Please use GitHub's private vulnerability reporting feature:

1. Open the repository's private vulnerability reporting form
2. Click "Report a vulnerability"
3. Fill out the form with details about the vulnerability

This ensures your report remains private until we can address it.

Do not open a public issue or pull request, and do not push proof-of-concept or fix commits to a public fork. Public activity can disclose the vulnerability before users have a patched release available.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 1 week
• Resolution Timeline: Depends on severity and complexity

1. We will acknowledge your report within 48 hours
2. We will triage the report in a draft GitHub Security Advisory
3. We will develop and review the fix in the advisory's temporary private fork
4. We will test the fix and prepare a patched release before public disclosure
5. We will coordinate disclosure timing and keep you informed of progress
6. We will credit you in the advisory and release notes unless you prefer anonymity

Published vulnerability information is kept in this repository's vulnerabilities/ directory. The repository record is the canonical public record; GitHub Security Advisories provide private coordination before disclosure and a synchronized publication mirror afterward.

This security policy applies to:

• The Epistola Suite application (apps/epistola)
• The Editor module (modules/editor)
• Official Docker images

• Third-party dependencies (please report to upstream maintainers)
• Issues in development/test environments only
• Social engineering attempts

That is about reporting — an upstream bug belongs with its maintainers. Vulnerabilities in components we ship are still ours to assess: see the kind: dependency records under vulnerabilities/.

When contributing, please:

• Never commit secrets, credentials, or API keys
• Follow secure coding practices
• Keep dependencies up to date
• Report any security concerns promptly

Thank you for helping keep Epistola Suite secure!