prosody

# Prosody Security Policy

## LLM-Generated Security Report Policy

Absolutely no security reports will be accepted that have been generated by LLM
agents.

## Supported Versions

Security reports are accepted for the most recent major release with support for
the previous major version ending immediately.

Prosody supports at most the three most recent versions of Elixir and supported
[Erlang/OTP versions][otp-versions].

As of January 2026, the support list is:

| Elixir | Erlang         |
| ------ | -------------- |
| 1.18   | 25, 26, 27, 28 |
| 1.19   | 26, 27, 28     |

The oldest supported version of Elixir will not be deprecated until six months
after the release of a new version of Elixir.

## Reporting a Vulnerability

Prefer creating a [private vulnerability report][advisory] with GitHub.
Alternatively, send an email to [security@elixir.halostatue.ca][email] with the
text `Prosody` in the subject. Emails sent to this address should be encrypted
using [age][age] with the following public key:

```
age1fc6ngxmn02m62fej5cl30lrvwmxn4k3q2atqu53aatekmnqfwumqj4g93w
```

[advisory]: https://github.com/halostatue/prosody/security/advisories/new
[age]: https://github.com/FiloSottile/age
[email]: mailto:security@elixir.halostatue.ca
[otp-versions]: https://hexdocs.pm/elixir/compatibility-and-deprecations.html#between-elixir-and-erlang-otp