# Security policy

ModelCraft is young; only `main` and the latest release get fixes.

Please **don't open a public issue** for a security problem. Report it privately through the
repository's [Security tab](https://github.com/jyviko/modelcraft/security/advisories/new) with
what you found, how to reproduce it (a model, deck or script), the version and platform, and the
impact you expect.

Reports are especially useful for opening untrusted models, decks or scripts (crashes, runaway
memory or CPU, path tricks) and for the control channel once it exists.