# Security Policy

## Supported Versions

We support the latest published release of ZenNotes. Security fixes land on
`main` first and roll into the next release.

## Reporting a Vulnerability

**Please do not open a public GitHub issue for security vulnerabilities.**

Report issues privately through GitHub's [private vulnerability reporting
form](https://github.com/ZenNotes/zennotes/security/advisories/new) for this
repository. Include:

- A description of the issue and the impact
- Steps to reproduce or a proof of concept
- Affected versions, if known
- Any suggested remediation

We aim to acknowledge reports within 3 business days and to ship a fix or
publish a coordinated advisory within 30 days of confirmation.

## Security Documentation

For the current product security model and deployment guidance, read:

- [docs/how-to/secure-self-hosting.md](docs/how-to/secure-self-hosting.md)
- [docs/how-to/at-rest-encryption.md](docs/how-to/at-rest-encryption.md)
- [docs/reference/security-reference.md](docs/reference/security-reference.md)
- [docs/explanation/security-model.md](docs/explanation/security-model.md)
