# Security policy

## Supported versions

Security fixes go into the latest release. Older releases are not patched; upgrade to the newest version.

## Reporting a vulnerability

Please do not open a public issue for a security problem. Write privately to **support@yaylali.uk** and include:

* the SimurgArray version (`simurg --version`),
* what an attacker could do and under which conditions,
* the smallest input or command that shows the problem, without real genetic data.

You will get an answer within a week. Once a fix is released, the report is credited in `CHANGELOG.md` unless you
prefer otherwise.

## What counts

SimurgArray reads files that users download from third parties. Problems worth reporting include:

* crafted IDAT, BPM, CSV, EGT, GTC, VCF or sample sheet files that crash the reader in an unsafe way, write outside
  the output folder, or execute code;
* HTML reports that run script from their input data (reports are meant to be safe to open and share);
* anything that could leak sample sheet metadata or genetic data beyond what the user chose to include.

## Handling genetic data

Genotype data are personal data. SimurgArray never sends data anywhere: it has no network access at run time and
its reports embed everything they need. Users are responsible for storing and sharing outputs according to their
consent and data protection rules. The QC report offers `--no-metadata`, `--drop-metadata` and `--keep-metadata` to
control what it contains.