# Security policy

## Reporting a vulnerability

We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.

**Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.**

Instead, please send a report to martin.donath@squidfunk.com with the following information:

1. A description of the vulnerability and its potential impact.
2. The steps required to reproduce the issue.
3. Any relevant files, screenshots, or proof-of-concept code.
4. Your name and contact information, if you would like to be credited.

## Our commitment

We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:

- **Acknowledgement** within 3 business days of your report.
- **Regular updates** on our progress as we investigate and address the issue.
- **Confidentiality** – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
- **Credit** – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.

## Supported versions

We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on **November 5, 2026**. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.

After **November 5, 2026**, Material for MkDocs will no longer receive public security updates as part of standard maintenance.

Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.

## Scope

This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.

We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.