# Security

> Privately report a vulnerability in InertiaX packages or websites.

Source: https://docs.inertiax.dev/security/

Report vulnerabilities by email to <security@inertiax.dev>, not in public issues, forums or social media.

This covers the InertiaX Composer and npm packages, and inertiax.dev and its subdomains. Out of scope: third-party services InertiaX uses (report those to their vendor), denial-of-service testing, and scanner output without a demonstrated impact.

## What to include

- the affected package and version, or the affected URL;
- steps to reproduce, with a minimal Table definition or proof of concept;
- the impact: what an attacker could read, change or do.

Leave out credentials, tokens and real user data.

## After you report

You get a reply by email, and updates until the report is resolved. For a package vulnerability, the changelog names the fixed versions and, if you want, credits you. Keep the details private until the fix is released, or until a disclosure date is agreed by email.

## Supported versions

Security fixes ship as new releases of maintained versions. Before 1.0, only the latest 0.x release is maintained: update to it to get fixes. From 1.0, the previous major also gets security fixes for a limited time after a new major ships; see the component’s support policy, for example [Table versions and support](https://docs.inertiax.dev/table/versions/).

## Test responsibly

Use your own installation and accounts. Do not access other people’s data or disrupt InertiaX services.