We are committed to providing a secure and reliable platform for astronomical research. This document covers the supported versions and the process for reporting vulnerabilities.

Because AstroRoom is a scientific tool in rapid development, we only support security fixes for the latest release on the main branch.

If you discover a security vulnerability (e.g., potential unauthorized data access, remote code execution, or credential exposure), please do not open a public issue. Publicly disclosing vulnerabilities can expose research data to risk before a fix can be widely deployed.

1. Draft a Detailed Report: Include a description of the vulnerability, steps to reproduce, and possible impact (e.g., local storage data leak).
2. Submit Privately: Send your report to the project maintainer (riptz5). You can use a GitHub private scientific inquiry if available.
3. Encrypted Communication: If the vulnerability is critical, we recommend PGP-encrypted communication. Reach out for a public key once initial contact is made.

We pledge to:

• Acknowledge your report within 48-72 hours.
• Provide a Fix or mitigation strategy as quickly as possible (typically within 1-2 weeks for critical issues).
• Keep You Informed throughout the remediation process.
• Credit the Reporter in our release notes (if desired) after the fix is publicly merged.

Thank you for helping keep AstroRoom secure for the scientific community!