# Security Policy

## Supported versions

Only the latest stable release is currently supported with security fixes. Upgrade to the latest version before reporting an issue; older releases may remain vulnerable.

## Reporting a vulnerability

Please report suspected vulnerabilities using [GitHub's private vulnerability reporting form](https://github.com/leocavalcante/pi-subagents/security/advisories/new). Do not disclose vulnerabilities in public issues, discussions, or pull requests.

Include the affected version, relevant platform and Pi/Node.js versions, a concise description of the impact, and reproducible steps where safe. Redact credentials, session data, private prompts, project contents, and other sensitive information from reports and logs. Do not attach authentication or configuration files.

Please allow the maintainers time to investigate and coordinate a fix before making a report public.