<!--
SPDX-FileCopyrightText: Simon Schneegans <code@simonschneegans.de>
SPDX-License-Identifier: CC-BY-4.0
-->

# :cherry_blossom: Kando Security Policy

Kando is a volunteer-run open source project. We maintain security updates for the latest **major release** only.

| Version | Supported |
|----------|------------|
| Latest (`main` branch) | ✅ |
| Older versions | ❌ |

If you are using an older version, please upgrade to the latest release.


## Reporting a Vulnerability

If you believe you have found a security vulnerability in Kando or one of its dependencies:

1. **Do not open a public issue.**
2. Instead, use GitHub’s [private vulnerability reporting](https://github.com/kando-menu/kando/security/advisories).

We aim to acknowledge all reports **within 7 days** and provide a status update within **14 days**.


## Security Best Practices

Kando does not run privileged code or access sensitive user data. Still, users should:
- Avoid downloading releases from untrusted sources.
- Keep Kando and its dependencies up to date.
- Verify checksums or signatures (if provided).

Thank you for helping keep Kando and the open-source community safe!

<p align="center"><img src ="docs/img/hr.svg" /></p>