# Apache Artemis Security Policy

Artemis is a project of the [Apache Software Foundation](https://apache.org) and follows the ASF [vulnerability handling process](https://apache.org/security/#vulnerability-handling).

## Reporting a Vulnerability

Before reporting a vulnerability please ensure:

- It falls within the scope of our [threat model](docs/user-manual/threat-model.adoc).
- It has not already been reported. Existing advisories are enumerated on [our website](https://artemis.apache.org/components/artemis/security).

To report a new vulnerability please follow the [ASF vulnerability reporting process](https://security.apache.org/report/).

## Supported Versions

Security updates are provided for the following versions:

| Version | Supported          |
|---------|--------------------|
| 2.x     | :white_check_mark: |
| 1.x     | :x:                |

We recommend always using the latest stable release to ensure you have the most recent security fixes.

## Security Severity Rating system

Apache Artemis uses [Apache's vulnerability severity rating system](https://security.apache.org/blog/severityrating/).
