# Security Policy

## Supported Versions

[![GitHub Release](https://img.shields.io/github/v/release/kimdre/doco-cd?include_prereleases&sort=semver&display_name=release&style=flat-square&label=Latest%20Version&color=%234CBB17)](https://github.com/kimdre/doco-cd/releases)
![GitHub Release Date](https://img.shields.io/github/release-date/kimdre/doco-cd?style=flat-square&label=Release%20Date&color=%234CBB17)

Only the latest version is supported.

Patches are only released for the latest version.

Versioning follows [Semantic Versioning](https://semver.org/), with the following format:

- Stable tags: `vX.Y.Z`
- Prerelease tags: `vX.Y.Z-rc.N`

Versions prior to `v1.0.0` can contain breaking changes anytime and are not guaranteed to be stable.

You can always find all release notes on GitHub:

- <https://github.com/kimdre/doco-cd/releases>

## Reporting a Vulnerability

If you believe you have found a security vulnerability, please report it to us through coordinated disclosure.

**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**

This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.

You may submit the report in the following ways:

- create a [private vulnerability report](https://github.com/kimdre/doco-cd/security/advisories/new)
- email opensource[@]drechsel.xyz.

Please include as much of the information listed below as you can to help us better understand and resolve the issue:

- Impact of the issue, including how an attacker might exploit the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- The version and/or location of the affected source code (tag/branch/commit or direct URL)
- The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
- Full paths of source file(s) related to the manifestation of the issue
- Any special configuration required to reproduce the issue

This information will help us triage your report more quickly.
