# Security Policy

## Supported Versions

The following list describes whether a version is eligible or not for security updates.

| Version | Supported          | EOL  |
| ------- | ------------------ |------|
| 2.4.x   | :heavy_check_mark: | 3.0.0 + 1 year |
| 2.3.x   | :x: | 28-Feb-2021  |
| 2.2.x   | :x: | 27-May-2020  |
| 2.1.x   | :x: | 20-Apr-2020  |
| 2.0.x   | :x: | 08-Mar-2020  |
| 1.5.x   | :x: | 31-Mar-2020 |
| < 1.5.0 | :x: | 27-Jun-2019 |

## Reporting a Vulnerability

In case you should find a vulnerability, please report it privately to me via [e-mail](mailto:paolostivanin@users.noreply.github.com).
The following is the workflow:
- security issue is found, e-mail is sent to me
- within 24 hours I will reply to your e-mail with some info like, for example, whether it actually is a security issue and how serious it is
- within 15 days I will develop and ship a fix
- once the update is out I will open a [security advisory](https://github.com/paolostivanin/OTPClient/security/advisories)
