# Security policy

Security fixes target the latest release. Older releases have no guaranteed
backport support. Upgrade before verifying whether an issue is still present.

Do not publish credentials, private photos, production logs, or working exploit
payloads in public issues. Contact the repository owner privately through the
hosting platform when available. If no private contact channel is available,
open an issue asking for a confidential reporting channel without technical
vulnerability details. There is currently no dedicated security mailbox or
promised response SLA.

A useful private report includes the affected version, deployment mode, required
permissions, impact, and minimal steps using mock data. Do not test on another
person's deployment or write to real frames without explicit authorization.