# Security Policy

## Supported Versions

The following table lists versions and whether they are supported. Security
vulnerability reports will be accepted and acted upon for all supported
versions.

| Version | Supported          |
| ------- | ------------------ |
| 3.6.x   | :white_check_mark: |
| 3.5.x   | :white_check_mark: |
| 3.4.x   | :x:                |
| 3.3.x   | :x:                |
| < 3.3   | :x:                |


## Reporting a Vulnerability

If you have found a security vulnerability, in order to keep it confidential,
please do not report an issue on GitHub.

Please email us details of the vulnerability at matplotlib-steering-council@numfocus.org;
include a description and proof-of-concept that is [short and
self-contained](http://www.sscce.org/).

You should expect a response within a week of your email. Depending on the
severity of the issue, this may require some time to draft an immediate bugfix
release. Less severe issues may be held until the next release.

We do not award bounties for security vulnerabilities.
