# Security Policy

## Supported Versions

Only the latest code on the `main` branch is supported.

## Reporting a Vulnerability

If you discover a security vulnerability (e.g., arbitrary file read/write, path traversal, permission bypass, information disclosure, or command injection), please do not disclose it in a public issue.

Please report it via one of the following channels:

- GitHub Security Advisories (recommended): create a private report via the repository's Security → Advisories page
- Or email: `qzfweb@gmail.com`

We will confirm receipt and provide a remediation plan as soon as possible. Please keep details private until a fix is released.
