# Security Policy

## Supported Versions

V is currently in active development. Because the language is evolving
rapidly, security updates and patches are generally only applied to the
latest stable release and the `master` branch.

| Version | Supported          |
| ------- | ------------------ |
| 0.5.x   | :white_check_mark: |
| < 0.5.x | :x:                |

## Reporting a Vulnerability

We take the security of the V programming language and its standard
library seriously.

If you discover a security vulnerability, please do **not** open a public
GitHub issue. Publicly disclosing a vulnerability can put users at risk
before a patch is available.

**How to report:**

1. Please use GitHub's **Private Vulnerability Reporting** feature. Go
   to the [Security tab](https://github.com/vlang/v/security) in this
   repository, click on **Report a
   vulnerability**.

2. Provide a clear description of the issue, the impact, and a Proof of
   Concept (PoC) code snippet to reproduce it.

**What to expect:**

* A maintainer will acknowledge receipt of your report as soon as
  possible.
* We will investigate the issue in a private fork.
* If the vulnerability is confirmed, we will develop a patch, credit
  you for the discovery, and coordinate a public disclosure alongside
  the fix.