# Security Policy

## Reporting a Vulnerability

If you find a potential security vulnerability please email security@ckan.org, rather than creating a public issue on GitHub.

We aim to respond to all valid reports within three working days.


## Supported Versions

Security updates are offered for the **2 most recent** minor CKAN releases. It is critical to always run the latest patch
release for a minor version. To find out the currently supported version and learn more about CKAN releases see here:

    https://docs.ckan.org/en/latest/maintaining/releases.html

Fixed security vulnerabilites are assigned a CVE and registered using [GitHub Security Advisories](https://github.com/ckan/ckan/security/advisories), and also included in the [CHANGELOG.rst](CHANGELOG.rst).

Again, only the latest patch release contains all security patches applied so please ensure your CKAN instance is running on a supported version to avoid exposing your users and your data.
