# Security Policy

## Supported Versions

Security updates are provided for maintained Vexta Core releases.

Supported release information should be published with each stable release.

## Reporting a Vulnerability

If you discover a security issue in Vexta Core, please report it privately.

Do not open a public GitHub issue for security-sensitive reports.

Please include:

- a clear description of the issue
- steps to reproduce, if available
- affected versions or commits
- potential impact
- any suggested mitigation

A dedicated security contact will be added before the first public stable release.

## Disclosure

Security reports should remain private until a fix is available and affected users have had reasonable time to upgrade.