# Security policy

Security fixes target the latest 0.x minor release. Please upgrade to its latest
patch release before reporting a problem.

Report vulnerabilities privately through this repository's GitHub Security tab:
choose **Report a vulnerability**. Include a minimal reproduction, affected
version, and an explanation of the impact. Avoid public issues for undisclosed
vulnerabilities.

Celestine is a pure computation library: it performs no network or filesystem
access at runtime. Build and development tooling are separate from this scope.
Calculation accuracy problems belong in bug reports unless they have a security
impact.