# SECURITY POLICY ## Supported Versions Security fixes are not backported to older **minor** versions. They are either released as a patch to the latest minor version branch, or included in a new minor version. When a new **major** version is released (`1.0`, `2.0`, etc), the previous one (`0.19.x`) will receive bug fixes for *at least* 3 months and security updates for 6 months after that new release comes out. (This policy may change in the future and exceptions may be made on a case-by-case basis.) ## Reporting a Vulnerability If you discover a security vulnerability within this package, please report it using any of the following methods: - [Open a private security advisory on GitHub](https://github.com/thephpleague/commonmark/security/advisories/new) - Use the [Tidelift security contact form](https://tidelift.com/security) - Email Colin O'Dell at All security vulnerabilities will be promptly addressed. Please do not disclose security-related issues publicly until a fix has been announced.