# Security policy

Supported security fixes target the latest release and the `main` branch.

Do not open public issues for vulnerabilities or include datasets, credentials, API keys, or
database URLs in reports. Report vulnerabilities privately through GitHub Security Advisories:

<https://github.com/dineshbarri/DataPilot-AI/security/advisories/new>

Include affected version, reproduction steps, impact, and a suggested mitigation when possible.
See [docs/SECURITY.md](docs/SECURITY.md) and [docs/THREAT_MODEL.md](docs/THREAT_MODEL.md).