blob: b89bbc294a27466b1003629c8d25e47973bf1f8a [file] [log] [blame] [view]
# Security Policy
## Supported Versions
Security fixes are not back-ported. Please make sure you are running at least the latest [release version](https://jsoup.org/download) of jsoup.
Please remember that jsoup is an Open Source library and is provided without any warranty. Before using jsoup in a critical environment, you should satisfy yourself that it works correctly and securely for your needs.
## Reporting a Vulnerability
If you believe or suspect you have identified a security vulnerability, please [report it](https://github.com/jhy/jsoup/security/advisories)
via the "Report a Vulnerability" button in Security Advisories.
([Details](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability))
We follow [Coordinated Disclosure](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/about-coordinated-disclosure-of-security-vulnerabilities) practices and ask that you do too.
Please provide as much detail as possible in your report, including the steps to reproduce the vulnerability and sample code.
Alternatively to using GitHub, or if you have a security question, please email `[email protected]`.
## Fixing Vulnerabilities
We take all vulnerability reports seriously and strive to fix them as quickly as possible. Once we receive a report, we will verify the vulnerability and its impact. We will then work to develop and test a fix for the vulnerability, and release it as soon as possible.