# Security Policy

## Email Contact

security@gpac.io

## Supported Versions

GPAC is under constant development using a continuous integration and deployment process. As a consequence the `HEAD` of the `master` branch is always considered as the _current version_ at any point. 

Thus only reports that are confirmed reproducible on the current `HEAD` of the `master` branch will receive a patch. 


## Reporting a Vulnerability

Vulnerabilities (as well as other bugs) should be reported directly using the [Github issue trakcer](https://github.com/gpac/gpac/issues). 

Please include all information needed to reproduce the issue, including a sample file. 

Sample files can be joined directly via github (preferred way) or uploaded to the [GPAC file drop](https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95).

However if public disclosure seems unreasonable, or if confidential information needs to be shared, you can contact security@gpac.io for private disclosure.
