# Security Policy

## Supported Versions

Security fixes are provided for the latest stable release line and the development branch.

| Version | Supported |
| --- | --- |
| 0.13.x | Yes |
| < 0.13.0 | No |

## Reporting a Vulnerability

Please do not open public issues for suspected security vulnerabilities.

Report vulnerabilities by emailing: <security@greysquirr3l.dev>

Include the following details when possible:

- A clear description of the issue and impact
- Affected crate(s), feature flags, and version(s)
- Reproduction steps or proof-of-concept
- Any known mitigations or workarounds

## Response Timeline

- Initial acknowledgment: within 72 hours
- Triage status update: within 7 days
- Fix plan or mitigation guidance: as soon as validated

## Disclosure Process

- We follow coordinated disclosure.
- After a fix is available, we publish release notes and any required migration guidance.
- Credit is provided in release notes unless you request anonymity.

## Scope

This policy applies to all crates and tooling in this repository, including:

- stygian-graph
- stygian-browser
- stygian-proxy
- stygian-charon
- stygian-mcp
- stygian-plugin
- stygian-extract-derive
