# Security Policy

## Reporting a vulnerability

Please report security problems privately, not as public issues.

The best way is GitHub's private reporting: open the
[Security tab](https://github.com/ancsemi/Haven/security) and choose
**Report a vulnerability**, or go straight to
[a new report](https://github.com/ancsemi/Haven/security/advisories/new).
Only the maintainers and you can see it.

If you can't use GitHub, email **ancsemi@haven-app.com** instead.

It helps to include:

- what an attacker can do, and what they need first (an account, a role, admin access)
- the steps to reproduce it, and the Haven version you tested
- the files involved and a suggested fix, if you have one

## What to expect

- A reply within a few days saying the report was received.
- Fixes ship in a normal Haven release. You're welcome to retest before it goes out.
- Once the fix is released, the advisory is published with credit to you, unless
  you'd rather stay anonymous.

Please keep the details private until the fix is released.

## Supported versions

Only the latest release gets security fixes. Haven updates in place, so the fix
for any problem is to update to the newest version.