# Security Policy

If you discover a security issue in `cupld`, please report it privately.

## Reporting

Use GitHub Security Advisories or GitHub private vulnerability reporting when enabled.
Do not open a public issue for security reports.

Include:

- Affected version(s)
- Steps to reproduce
- Impact and potential exploitability
- Any mitigation you can confirm

## Response

- We will acknowledge receipt quickly.
- We will investigate and prioritize a fix.
- We will publish a coordinated disclosure timeline once a patch is available.

## Supported Versions

Please report issues against the latest tagged release on `main` whenever possible.
