The GrowthJar team actively maintains the latest minor release of the main branch. We provide security updates for:

Security patches are generally backported to the most recent release train when technically feasible. Versions that have reached end-of-life will not receive fixes.

If you discover a security vulnerability, please do not create a public issue. Instead:

1. Email the security team at security@growthjar.io with the subject line SECURITY. Use encrypted communication if possible.
2. Provide a detailed description of the vulnerability, including steps to reproduce, affected components, and potential impact.
3. Include any proof-of-concept code, logs, or screenshots that help demonstrate the issue.

We aim to acknowledge receipt within 2 business days and will provide status updates at least once per week until the issue is resolved.

• After validating the report, we will work with you to develop a fix and coordinate a release.
• Please allow us reasonable time to deploy the fix before publicly disclosing the issue (a 90-day embargo is typical, though urgent cases may be resolved sooner).
• Credit will be given to reporters who request acknowledgment in the release notes, unless anonymity is preferred.

The security policy applies to all code, infrastructure, and services hosted within the GrowthJar GitHub organization, including the client, server, and any supporting tooling defined in this repository.

For non-security bugs, feature requests, or general questions, please use GitHub Issues or Discussions instead of the security channel.