# Security Policy

## Supported Versions

Due to limited resources, only the latest version of `django-guardian` is supported with security updates. We do not generally issue security fixes for older minor release lines.

## Reporting a Vulnerability

Please do NOT describe issues which may indicate vulnerabilities or demonstrate possible exploits in an issue, which will be public.

Instead, prepare a clear description and, if possible, a minimal reproduction or demo of the exploit, then use the repository's [private vulnerability reporting flow](https://github.com/django-guardian/django-guardian/security) to report it confidentially.

## How we manage vulnerabilities

The maintainers will review the report, coordinate a fix, and use GitHub's security tooling to publish an advisory when appropriate.
