The table below outlines which versions of Marginalia are actively receiving security updates.

If you discover a security vulnerability in Marginalia, please do not open a public issue. Publicly disclosing vulnerabilities makes the application susceptible to exploitation before a patch can be delivered.

Instead, please report vulnerabilities via one of the following methods:

1. GitHub Security Advisories: You can report vulnerabilities privately by selecting the Security tab in the GitHub repository and clicking Report a vulnerability to open a draft advisory.
2. Direct Email: Alternatively, you can email the maintainer directly at plbogen@google.com.

Please include the following information in your report:

• A detailed description of the vulnerability.
• Steps to reproduce the vulnerability (including proof-of-concept scripts or payload requests).
• Potential impact of the vulnerability.

Upon receiving a report, we will:

1. Acknowledge receipt of the vulnerability report within 48 hours.
2. Work to verify and fix the vulnerability in a private branch.
3. Coordinate a release patch and publish a security advisory detailing the vulnerability and its mitigation.