# Security Policy

## Supported Versions

| Version | Supported |
| ------- | --------- |
| Latest  | Yes       |
| Older   | No        |

## Reporting a Vulnerability

**Please do not open public issues for security vulnerabilities.**

### Primary: GitHub Private Vulnerability Reporting

Report via GitHub's built-in private reporting:

https://github.com/AnyiWang/OpenCovibe/security/advisories/new

### Backup: Email

If the GitHub channel is unavailable, email `security@opencovibe.com`.

## Scope

This policy covers the OpenCovibe desktop application itself (Tauri, Rust backend, Svelte frontend). Vulnerabilities in upstream CLIs (Claude Code, Codex) should be reported to their respective maintainers.

## Response Timeline

- **Acknowledgment**: within 72 hours of report
- **Fix**: a patch release will be issued as soon as a fix is ready

## Disclosure

Vulnerabilities will be publicly disclosed after a fix has been released.
