SECURITY.md

Rama main · réplica de lectura del repositorio original.

# Security policy

## Reporting a vulnerability

Please do not open a public issue for a security problem. Write to
**security@lyriks.io** with:

- the version or commit you tested (Settings > Versions in the application,
  or the git commit for a source build),
- steps to reproduce, and what an attacker gains,
- whether the problem needs an account, and which role.

You will get an acknowledgement within three working days, and a fix or a
mitigation plan within thirty days for confirmed issues. We credit reporters
in the release notes unless they prefer otherwise.

## Scope

This repository is the Community edition of the Lyriks platform. Reports about
the hosted services of lyriks.io, the appliance kit, or the Enterprise
components are welcome at the same address.

## Supported versions

Only the latest release receives security fixes. The appliance updates in
place with `./lyriks update`.