Security Policy

The security policy lives with the code, so it always matches the versions that are supported today:

Read SECURITY.md in verdaccio/verdaccio →

It explains which versions receive security fixes, how responsible disclosure works, the private channels to report a vulnerability and the project's PGP key.

If you found a vulnerability, do not open a public issue or discussion. Follow the report instructions in the policy so it can be triaged in private first.

The policy is also available on GitHub, under the Security tab of the repository.