# Security policy

## Reporting a vulnerability

Please report security issues privately, not on the public issue tracker.

Email <danix@danix.xyz>, encrypted to the maintainer's OpenPGP key if you can:

    110E 1B11 1BA2 C3C7 CCD1  27B8 F96B 36CA CC44 17AE

Fetch it with either of these, and check that the fingerprint matches:

    gpg --locate-keys danix@danix.xyz
    gpg --keyserver hkps://keys.openpgp.org --recv-keys 110E1B111BA2C3C7CCD127B8F96B36CACC4417AE

Include the HardenedPass version (Settings, About), the Android version, and the
steps to reproduce.

## Supported versions

Only the latest release gets fixes. No app store delivers HardenedPass updates:
install the newest APK from
[GitHub Releases](https://github.com/danixland/HardenedPass/releases/latest).