# Security Policy

## Supported Versions

The .NET, .NET Core and ASP.NET Core support policy, including supported versions can be found at the [.NET and .NET Core Support Policy Page](https://dotnet.microsoft.com/platform/support/policy/dotnet-core).

## Reporting a Vulnerability

**Please do not open issues on GitHub for anything you think might have a security implication.**

Security issues and bugs should be reported privately to the Microsoft Security Response Center (MSRC), via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new).

You should receive a response within 24 hours. If for some reason you do not, please follow up via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/), using the Message functionality found at the bottom of the Activity tab on your vulnerability report.

Further information can be found in the MSRC [Report an issue and submission guidelines](https://www.microsoft.com/en-us/msrc/faqs-report-an-issue).

Reports via MSRC may qualify for the Microsoft .NET Bug Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at [https://aka.ms/corebounty](https://aka.ms/corebounty).

