# Security Policy

## Supported versions

The latest `main` branch and the currently supported NixOS unstable toolchain
receive security fixes. Older revisions are not supported.

## Reporting a vulnerability

Do not open a public issue. Submit a report through
[GitHub private vulnerability reporting](https://github.com/nix-forge/nix-conf/security/advisories/new).
If that form is unavailable, contact the maintainer through the private address
listed on the GitHub profile and request an encrypted channel.

Please include the affected commit or version, the relevant host or module
configuration, impact, and a minimal reproduction. Do not include live secrets
or private identities in a report.

We aim to acknowledge reports within 3 business days, provide an initial
assessment within 7 business days, and agree coordinated disclosure timing with
the reporter. Good-faith research that avoids privacy violations, persistence,
destructive actions, and third-party systems is welcome.
