| # Security Policy | |
| ## Reporting a Vulnerability | |
| ### Vulnerabilities (as well as other bugs) should be reported directly using the [Github issue tracker](https://github.com/gpac/gpac/issues/new?template=bug_report.md). | |
| Corner cases which do not lead to some security concerns are not considered as part as our security policy. For example isolated overflows generated by fuzzers and reported by ASAN and not leading to a crash are excluded. | |
| Please include all information needed to reproduce the issue, including a sample file. | |
| Sample files can be joined directly via github (preferred way) or uploaded to the [GPAC file drop](https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95). | |
| If you require a CVE ID you can request one from [MITRE](https://cveform.mitre.org/) or other CNAs. We do not assign CVE IDs ourselves. We do not use Github's Security Advisories, the issue tracker provides a public reference if needed. | |
| ## Supported Versions | |
| GPAC is under constant development using a continuous integration and deployment process. As a consequence the `HEAD` of the `master` branch is always considered as the _current version_ at any point. | |
| Thus only reports that are confirmed reproducible on the current `HEAD` of the `master` branch will receive a patch. | |
| ## Email Contact | |
| If public disclosure seems unreasonable, or if confidential information needs to be shared, you can contact security@gpac.io for private disclosure. | |
| Use security@gpac.io for all other security-related inquiry. |