# Security Policy

## Reporting a vulnerability

**Please do not open a public GitHub issue for security problems.**

Report suspected vulnerabilities privately by email to
**security@lvgl.io**.

Please include, as far as you can:

- the affected version(s) and configuration (`lv_conf.h` toggles, target),
- a description of the impact,
- steps to reproduce or a proof of concept, and
- any suggested fix or mitigation.

We support coordinated disclosure: please give us a reasonable window to
release a fix before any public disclosure. We will credit you in the advisory
unless you prefer otherwise.

## Supported versions

Fixes are made available for the actively supported releases. See the
[Policies page](https://docs.lvgl.io/master/introduction/policies) for the
current support table.

## SBOM and more

LVGL publishes a machine-readable SBOM (SPDX 3.0.1) in the [`sbom/`](sbom/)
folder and a human-readable component list in
[`COPYRIGHTS.md`](COPYRIGHTS.md).

For our full security commitment, vulnerability handling process, and how LVGL
supports users' EU Cyber Resilience Act (CRA) obligations, see the
[Security page in the documentation](https://docs.lvgl.io/master/introduction/security).