# Security Policy

## Supported Versions

Security updates are provided for the latest stable release line.

| Version | Supported |
| ------- | --------- |
| 0.3.x   | ✅        |
| < 0.3.0 | ❌        |

## Reporting a Vulnerability

Please do not report security issues in public Issues or Discussions.

Use GitHub Private Vulnerability Reporting:

- https://github.com/0neShot101/rbxdev-ls/security/advisories/new

Include the following details:

- Affected component (language server, VS Code extension, MCP package, bridge script, or Studio plugin)
- Affected version/commit
- Reproduction steps or proof of concept
- Expected vs actual behavior
- Impact assessment (what an attacker can do)

## Response Process

- Initial acknowledgment target: within 72 hours
- Triage/update target: within 7 days
- Fixes are released in a patched version as soon as practical

If your report is valid, we will coordinate disclosure timing with you and credit you if requested.
