Security Policy
Supported Versions
Two latest incompatible releases (e.g. 2.0.0 and 1.9.0).
Latest release gets all bug fixes, features, etc. Previous incompatible release gets security fixes and fixes for problems that render software completely unusable in certain configurations with no workaround.
Reporting a Vulnerability
If you believe the vulnerabilitiy does have a big impact on existing
deployments - email fox.cpp at disroot.org, put "[maddy security]" in the
Subject.
Otherwise, open a public issue.