# Security policy

See [docs/security.md](docs/security.md) for the threat model and controls.

## Supported versions

| Version | Supported |
|---------|-----------|
| 1.x     | ✅ |
| < 1.0   | ❌ |

## Reporting a vulnerability

Please do **not** open a public issue. Instead:

1. Open a GitHub Security Advisory on this repo, **or**
2. Email `security@lumen.example` with details and (ideally) a minimal repro.

We aim to acknowledge within 2 business days and to ship a fix within 30 days for high/critical findings.
