| # Security Policy |
| |
| ## Supported Versions |
| | Version | Supported | |
| | ------- | ------------------ | |
| | 3.3.x | :white_check_mark: | |
| | 2.1.x | :white_check_mark: | |
| | < 2.1.1 | :x: | |
| |
| ## Reporting a Vulnerability |
| **DO NOT** create a public GitHub issue for security vulnerabilities. |
| Instead, please report it via the following channels: |
| |
| 1. **Email:** bcollins@libjwt.io (Encrypted PGP preferred) |
| 2. **GitHub Private Report:** Use the "Private Security Report" feature on this repository. |
| |
| ## What to Include |
| - Description of the vulnerability. |
| - Steps to reproduce the issue. |
| - Impact assessment (e.g., "Creates weak tokens"). |
| - Suggested fix (optional). |
| |
| ## Response Timeline |
| - **Acknowledgement:** Within 48 hours. |
| - **Resolution:** Within 7 days for critical issues. |
| - **Disclosure:** Public advisory after the fix is released. |
