# Security Policy

## Supported Versions

| Branch | Beta Release | Initial Release | Active Support Until | Security Support Until *
|--|--|--|--|--|
|2.15  | 27 Sep 2019 | 8 Oct 2019 | 8 Oct 2019 | 8 Oct 2019
|2.16  | 30 Jan 2020 | 13 Feb 2020 | 15 June 2020 | 15 December 2020
|3.0   | 27 Jan 2020 | 15 June 2020 | 15 June 2021 | 15 December 2021

* = Security Support for 2.16 will only be provided for Mautic itself, not for core dependencies that are EOL like Symfony 2.8.

## Reporting a Vulnerability

If you think you’ve found a potential security threat within Mautic please follow these quick steps on reporting that problem:

1. Verify the issue is a security issue.
Lost passwords, lost access, additional features, or random bugs are not considered security issues. Also Mautic.org does not host anyone’s platform, Mautic.org provides the platform which users can install on their own server. Mautic.org therefore has no control over who uses the software or how they choose to use it. If your issue is a security issue please continue to step 2.

2. Report the issue
Please email security [at] mautic.org with as many of the details as possible. Typically you should be able to explain what the security hole is, how it can be manipulated, and how a tester can verify the existence of the problem.
