# Security Policy

## Supported Versions

The following list describes whether a version is eligible or not for security updates.

| Version | Supported              | EOL         |
|---------|------------------------|-------------|
| 4.4.x   | :white_check_mark: Yes | -           |
| 4.3.x   | :white_check_mark: Yes | 30-Apr-2026 |
| 4.2.x   | :x: No                 | 20-Feb-2026 |
| 4.1.x   | :x: No                 | 06-Feb-2026 |
| 4.0.x   | :x: No                 | 30-Jun-2025 |

## Reporting a Vulnerability

If you discover a potential security vulnerability, please report it **privately** via email to [info@paolostivanin.com](mailto:info@paolostivanin.com)

### Disclosure Process

The responsible disclosure process is as follows:

1. A security issue is reported via email.
2. Within **24 hours**, you will receive an acknowledgment with initial feedback (e.g. confirmation of the issue and its severity).
3. Within **7 days**, a fix will be developed and released.
4. Once the fix is publicly available, a corresponding [security advisory](https://github.com/paolostivanin/OTPClient/security/advisories) will be published.
