---
title: "Security policy"
slug: SECURITY
---

<a id="security-policy"></a>

## Supported versions

Astral is pre-1.0 and under active development. Security fixes are applied to `main` (or the default branch).
If/when release branches exist, this document will be updated with an explicit support matrix.

## Reporting a vulnerability

Please report security issues through GitHub's private vulnerability reporting
form under the repository's Security tab. Do not open a public issue with
vulnerability details.

Include:
- A clear description of the issue and impact
- Reproduction steps / PoC (if available)
- Affected platform(s), build preset(s), and commit SHA
- Any suggested fix or mitigation

If the private reporting form is unavailable, open an issue containing no
technical details and ask the maintainers to enable a private disclosure
channel.

## Disclosure process

1. Triage and confirm the issue.
2. Develop a fix and add regression coverage when practical.
3. Coordinate disclosure timing (especially for downstream engine/plugin consumers).
4. Publish an advisory and release notes when a tagged release process exists.

Source: [View the pinned source](https://github.com/Cosmin-B/astral-runtime/blob/f2d13b77c70624ede5bc06823d4a794a4b955e10/SECURITY.md) · [Edit this source](https://github.com/Cosmin-B/astral-runtime/edit/main/SECURITY.md)