# Security Policy

## Supported Versions

Security fixes are applied to the latest version.

## Reporting a Vulnerability

If you find a potential security issue, please report it using the
[private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) feature of GitHub to
automatically inform all relevant team members. Otherwise, please
get in touch with stefan6419846 through e-mail (current maintainer,
address in GitHub profile).

Please have a look at our [corresponding user documentation](https://pypdf.readthedocs.io/en/stable/user/security.html)
as well, which includes some information about possibly invalid reports.

Additionaly, our [AI policy](https://github.com/py-pdf/pypdf/blob/main/CONTRIBUTING.md#ai-policy)
should be considered. Reported issues we are unable to reproduce due to an
invalid or missing proof-of-concept might be closed directly.

We will try to find a fix in a timely manner and then issue a security
advisory together with the update via GitHub, as well as requesting a CVE
([example](https://github.com/py-pdf/pypdf/security/advisories/GHSA-xcjx-m2pj-8g79)).

If you do not get a reaction within 30 days, please open a public issue on GitHub.
