# Security Policy

## Supported Versions

Readest does not currently maintain separate release channels. Security updates are provided only for the latest release series.

| Version | Supported          |
| ------- | ------------------ |
| 0.10.x  | :white_check_mark: |
| < 0.10  | :x:                |

## Reporting a Vulnerability

Please report suspected vulnerabilities privately. Do not open a public GitHub
issue or discussion for security-sensitive reports.

Use GitHub's private vulnerability reporting for this repository:

<https://github.com/readest/readest/security/advisories/new>

When submitting a report, include:

- A clear description of the issue and the affected component
- Steps to reproduce, proof of concept, or a minimal test case
- The versions, platforms, or environments you tested
- Any suggested remediation or mitigating details, if available

What to expect after you report:

- We will aim to acknowledge receipt within 3 business days.
- We may contact you for additional details, reproduction steps, or validation.
- If the report is accepted, we will work on a fix and coordinate disclosure.
- If the report is declined, we will explain why, for example if the behavior is
  expected, unsupported, or not reproducible.

Please keep vulnerability details private until a fix is available and the
maintainers have approved disclosure.