# Mnemonist Security

## LLM-Generated Security Report Policy

Absolutely no security reports will be accepted that have been generated by LLM
agents.

## Supported Versions

Security reports are accepted only for the most recent major release and the
previous version for a limited time after the initial major release version.
After a major release, the previous version will receive full support for three
months and security support for an additional three months (for a total of six
months).

Mnemonist supports the three most recent versions of Elixir and supported
[Erlang/OTP versions][otp-versions].

As of August 2025, the support list is:

| Elixir | Erlang         |
| ------ | -------------- |
| 1.16   | 24, 25, 26     |
| 1.17   | 25, 26, 27     |
| 1.18   | 25, 26, 27, 28 |

The oldest supported version of Elixir will not be deprecated until six months
after the release of a new version of Elixir.

## Reporting a Vulnerability

Send an email to [mnemonist@halostatue.ca][email] with the text `Mnemonist` in
the subject. Emails sent to this address should be encrypted using [age][age]
with the following public key:

```
age1fc6ngxmn02m62fej5cl30lrvwmxn4k3q2atqu53aatekmnqfwumqj4g93w
```

[age]: https://github.com/FiloSottile/age
[email]: mailto:mnemonist@halostatue.ca
[otp-versions]: https://hexdocs.pm/elixir/compatibility-and-deprecations.html#between-elixir-and-erlang-otp