# Security Policy

## Supported Versions

Only the latest release is supported with security updates.

| Version | Supported |
|---------|-----------|
| Latest  | Yes       |
| Older   | No        |

## Reporting a Vulnerability

**Do not open a public issue for security vulnerabilities.**

Please report vulnerabilities through [GitHub Security Advisories](https://github.com/yonatangross/orchestkit/security/advisories/new).

Alternatively, email **yonatangross** via the contact information on the GitHub profile.

### What to Include

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

## Response Timeline

- **48 hours**: Acknowledgment of your report
- **7 days**: Initial assessment and severity determination
- **30 days**: Target for fix release (may vary by severity)

## Disclosure Policy

- No public disclosure until a fix is available
- Credit will be given to reporters (unless anonymity is requested)
- We follow [coordinated vulnerability disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure)
