Unless a repository documents a different policy, security fixes are provided for the latest release and the default branch only.

Please do not open a public issue for a suspected vulnerability.

• If the repository exposes a Report a vulnerability form under its Security tab, use that private form.
• Otherwise, email hello@zenstory.ai with the repository name, affected version or commit, impact, reproduction steps, and any proof of concept.

We aim to acknowledge reports within 72 hours and provide an initial assessment within five business days. Please allow reasonable time for investigation and a coordinated fix before public disclosure.

This policy covers source code and releases maintained by the zenstory-ai organization. Vulnerabilities in third-party services or dependencies should also be reported to their respective maintainers when appropriate.

Thank you for helping keep ZenStory and its users safe.