# Security policy

## Supported versions

Security fixes target the latest released code. The current public release is **0.1.0**, for Node.js 22.19.0+ and Pi 1.3.0+.

## Report a vulnerability

Use GitHub's [private vulnerability reporting](https://github.com/hyein-cbio/pi-codemode-usage/security/advisories/new). Do not post credentials, real databases, private paths, or session logs in a public issue.

Include the affected version, a minimal reproduction with synthetic data, and the expected security impact. There is no guaranteed response-time SLA.

For what is recorded and how to remove it, see [privacy and deletion](docs/privacy.md).