# Security Policy

## Supported Versions

We follow [Calendar Versioning](https://calver.org) with generous backwards-compatibility guarantees.
Therefore, we only support the latest version.

That said, you shouldn't be afraid to upgrade if you're only using our documented public APIs and pay attention to `DeprecationWarning`s.
Whenever there is a need to break compatibility, it is announced in the changelog and raises a `DeprecationWarning` for a year (if possible) before it's finally really broken.

> [!WARNING]
> What explicitly *may* change over time are the default [hashing parameters](https://argon2-cffi.readthedocs.io/en/stable/parameters.html) and the behavior of the [CLI interface](https://argon2-cffi.readthedocs.io/en/stable/cli.html).


## Security contact information

To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
Tidelift will coordinate the fix and disclosure.
