# Security policy

## Reporting a vulnerability

If you discover a security issue in this package, **please report it
privately** so we can fix it before it's exploited.

- **Email:** support@modpackqt.com
- **Response time:** we aim to acknowledge within **2 business days** and
  publish a fix or mitigation within **90 days** of the report.

Please include:

- Affected version(s)
- A short description of the impact
- Steps or a proof-of-concept to reproduce
- Your preferred name for credit (or anonymous)

We follow [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure):
we will not publish the issue until you've had a chance to verify the fix or
the 90-day window has elapsed.

## Supported versions

| Version | Status |
|---|---|
| `2.x`   | ✅ Active — security fixes within 90 days |
| `1.x`   | ❌ End of life — please migrate to 2.x |

## What is in scope

- The Node-RED nodes shipped in this package
- The embedded Modbus TCP slave server
- The traffic event bus
- Authentication and rate-limiting code paths

## What is out of scope

- Vulnerabilities in our dependencies (please report those upstream — for
  example to [`modbus-serial`](https://github.com/yaacov/node-modbus-serial))
  — but tell us too so we can pin a safe version
- Issues that require an attacker to already have control of the Node-RED
  runtime (Node-RED is not a sandbox)
- Denial-of-service caused by the free-tier rate limit (this is by design)

## Hall of fame

We credit security reporters in this section unless they request anonymity.

_(none yet)_