# Security Policy

## Supported Versions

Bartholomew Trust Protocol (BTP) adheres to deterministic security release lifecycles:

| Version | Supported          |
| ------- | ------------------ |
| 5.4.x   | :white_check_mark: |
| 5.3.x   | :white_check_mark: |
| < 5.3   | :x:                |

## Reporting a Vulnerability

The Bartholomew team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose findings.

### Disclosure Process
1. **Email Directly**: Send details to [security@bartholomew.info](mailto:security@bartholomew.info) or [itsub@bartholomew.info](mailto:itsub@bartholomew.info).
2. **Include Details**:
   - Description of the AST bypass, micro-escrow collision, or attestation anomaly.
   - Minimal reproduction code or test payload.
   - Any proposed remediation.
3. **Response SLA**:
   - Critical / RCE / AST Bypass: Within 4 hours.
   - Attestation / Merkle Chaining: Within 24 hours.
   - General Inquiries: Within 48 hours.

We kindly ask that you refrain from public disclosure until an official patch has been released.