# Security Policy

## Supported Versions

- The latest release on GitHub.
- The current `main` branch.

Older tags and ad-hoc forks may receive guidance, but they are not guaranteed security backports.

## Reporting a Vulnerability

Please do not report security issues in public issues, discussions, or pull requests.

Use one of these channels:

1. GitHub Security Advisory private report: `https://github.com/cita-777/metapi/security/advisories/new`
2. Email: `cita-777@users.noreply.github.com` with subject prefix `[metapi security]`

When reporting, include:

- Affected version, commit, or deployment mode
- Affected endpoint, module, or configuration surface
- Reproduction steps or proof-of-concept
- Expected impact and attack preconditions
- Any logs, screenshots, or packets with secrets redacted
- Suggested mitigation or patch ideas, if you already have them

## Response Process

- We aim to acknowledge private reports within 3 business days.
- We aim to provide an initial triage or follow-up questions within 7 business days.
- We may ask for extra reproduction details, redacted logs, or environment information before confirming severity.
- We coordinate disclosure with the reporter when possible. Please keep the report private until a fix or mitigation is ready.

## Handling Public Reports

If a vulnerability is posted publicly by mistake, maintainers may redact sensitive details, convert the report to a private channel, or close the public thread after redirecting the reporter to the private process above.