# Security Policy

## Supported Versions

AICTX is currently in beta. Security fixes are generally applied to the latest
released version and the default branch.

| Version | Supported |
| ------- | --------- |
| Latest release | Yes |
| Default branch | Yes |
| Older releases | Best effort |

## Reporting a Vulnerability

Please do not open a public issue for sensitive security reports.

If you believe you have found a vulnerability, open a minimal issue requesting
private maintainer contact, without including exploit details or sensitive data.
Use the project issue tracker:

<https://github.com/oldskultxo/aictx/issues>

Include only safe high-level information publicly, such as the affected area and
how to contact you. The maintainers will coordinate a private channel for the
full report when possible.

## What to Include

When reporting privately, include:

- affected AICTX version or commit;
- affected command, runtime path, or integration;
- operating system and Python version;
- clear reproduction steps;
- impact assessment;
- any suggested mitigation or patch.

## Response Expectations

Maintainers will make a best-effort attempt to acknowledge reports promptly,
investigate the issue, and coordinate disclosure and fixes based on severity.
