# Security Policy

## Supported Versions

Only the latest commit of the .svg, .eot, .ttf, .woff, .woff2, and .css files are supported. Support is best-effort and a fix/patch isn't guaranteed.

## Reporting a Vulnerability

[Please use GitHub's page.](https://github.com/JackDunnCodes/hugeicons-font/security/advisories/new)

Vulns in Hugeicons itself may be forwarded to Hugeicons. Vulns in jsDelivr will be forwarded to jsDelivr (but should be reported directly to them).

We don't operate a bug bounty but we do credit researchers.

We would **love** it if you provide a patch to fix it too!

## Responsible Disclosure

Please wait 2 months after telling us and receiving no response at all before publicly disclosing.

If/when you receive a response, please wait 6 months until after the last response before publicly disclosing, unless otherwise told.

Once fixed, please wait 1 month before publicly disclosing details, to avoid blindsiding developers. You may disclose broad, un-exploitable information about the issue as soon as the fixed code has a release tag.

If we actively refuse a fix as the issue is not considered a security issue, you may disclose immediately, unless you wish us to reconsider - in which case the above applies.