# Security policy

> How to report a vulnerability in Tinka, which versions get security fixes, and how stable Tinka's APIs are at each stage.

This page covers Tinka's security policy. You will learn how to:

- Report a vulnerability privately
- Know which versions get security fixes
- Know which APIs can change, from the alpha to `v1.0.0`

## Overview

Tinka is the foundation your App's security rests on, so its own security is handled with care: issues are reported privately, fixed before they're disclosed, and published where Go's tooling finds them, so `govulncheck` tells you when your App uses an affected version.

## Report a vulnerability

Report security issues privately, through GitHub's private vulnerability reporting: open the repository's **Security** tab and choose **Report a vulnerability**. Don't open a public issue, pull request or discussion for a security problem: until a fix is released, everyone who uses Tinka would be exposed.

Include what you found, the version (`tinka version`, or the version in your App's `go.mod`), and the steps or code that show it. You'll get an answer within a week. Once a fix is released, the issue is published as a GitHub security advisory and in Go's vulnerability database. Reporters are credited, unless they ask not to be.

## Supported versions

Until `v1.0.0`, only the latest release gets security fixes: a fix ships in the next release, and you upgrade to get it. From `v1.0.0`, the latest minor release of `1.x` gets fixes.

Check your App for known vulnerabilities, in Tinka, Go and every other module it uses, with `govulncheck`:

```sh
go run golang.org/x/vuln/cmd/govulncheck@latest ./...
```

It reports only the vulnerabilities your code can reach.

## Stability

How much Tinka's APIs can change depends on the release:

| Release | APIs |
|---|---|
| Alpha (`v1.0.0-alpha.N`) | Can change between releases. The [release notes](releases.md) mark every change that alters behavior as "Changed" |
| Beta (`v1.0.0-beta.N`) | Settled. Releases fix bugs and security issues only |
| `v1.0.0` and later | No breaking changes within `1.x`, so upgrading Tinka is as safe as upgrading Go |

During the alpha, pin the version your App builds against in its `go.mod`, and read the release notes before you upgrade.

See also: [Releases](releases.md), [Roadmap](roadmap.md), [Contributing](contributing.md)