# Security Policy

## Supported Versions

Security fixes are published for the versions marked below. The
[State of support](https://github.com/lestrrat-go/jwx/discussions/1079)
discussion is the canonical, up-to-date statement; this table summarizes it.

| Version  | Supported          |
| -------- | ------------------ |
| v4.x.x   | :white_check_mark: Current release |
| v3.x.x   | :white_check_mark: Previous release; receives regular fixes |
| v2.x.x   | :x: Unmaintained. Do not use |
| v1.x.x   | :x: Unmaintained. Do not use |
| < v1.0.0 | :x: Unmaintained. Do not use |

Unmaintained versions receive no fixes of any kind, including for issues
already fixed in a supported version. Each advisory names the versions that
carry the fix; a version not named there stays affected.

## Reporting a Vulnerability

If you think you found a vulnerability, please report it via [GitHub Security Advisory](https://github.com/lestrrat-go/jwx/security/advisories/new).
Please include explicit steps to reproduce the security issue.

We will do our best to respond in a timely manner, but please also be aware that this project is maintained by a very limited number of people. Please help us with test code and such.