# Security Policy

## Supported Versions

The following list describes whether a version is eligible or not for security updates.

| Version | Supported          | EOL         |
|---------|--------------------|-------------|
| 4.0.x   | :white_check_mark: | -           |
| 3.7.x   | :white_check_mark: | 30-Sep-2024 |
| 3.6.x   | :white_check_mark: | 31-Aug-2024 |
| 3.5.x   | :x:                | 31-Mar-2024 |
| 3.4.1   | :x:                | 31-May-2024 |
| 3.4.0   | :x:                | 29-Feb-2024 |
| 3.3.x   | :x:                | 29-Feb-2024 |
| 3.2.x   | :x:                | 31-Jan-2024 |

## Reporting a Vulnerability

In case you should find a vulnerability, please report it privately to me via [e-mail](mailto:info@paolostivanin.com).
The following is the workflow:
- security issue is found, an e-mail is sent to me
- within 24 hours I will reply to your e-mail with some info like, for example, whether it actually is a security issue and how serious it is
- within 7 days I will develop and ship a fix
- once the update is out I will open a [security advisory](https://github.com/paolostivanin/OTPClient/security/advisories)
