# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 1.9.x   | :white_check_mark: |
| < 1.9.0 | :x:                |

## Reporting a Vulnerability

We take the security of getID3 seriously. If you discover a vulnerability, please report it responsibly rather than opening a public issue.

### Preferred Method: GitHub Private Vulnerability Reporting
If enabled on this repository, please navigate to the **[Security tab](../../security/advisories)** and click **"Report a vulnerability"**. This creates a confidential draft advisory where we can discuss details, collaborate on a fix, and coordinate disclosure privately.

### Alternative Method: Email
If Private Vulnerability Reporting is unavailable, please email details directly to:

📧 **info@getid3.org**

### What to Include
Please provide as much detail as possible to help us reproduce and fix the issue quickly:
- Type of issue (e.g. CWE, vulnerability class)
- Affected files, functions, and line numbers
- Clear step-by-step reproduction steps or a minimal proof of concept (PoC)
- Environment details (PHP version, OS, relevant PHP extensions)
- Any proposed remediation or patch diff