<!--
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

# Security Policy

Apache Grails is committed to the continued innovation, development, maintenance, and support of the Grails framework.
Our goal is to provide Grails framework users the support they need while maintaining as much focus as possible on innovation.
The level and type of support available for earlier versions of the Grails framework will change as the framework continues to evolve.

For information about the currently supported versions of the Grails framework, please see our [Support Schedule](https://grails.apache.org/support-schedule.html).

## Reporting Vulnerabilities

Please see the page of the [ASF Security Team](https://www.apache.org/security/) for further information and contact information.

## Threat Model

The framework's threat model - what is in scope, what is out, what security properties are claimed, what is explicitly disclaimed, and how inbound reports and findings are triaged - is documented in [THREAT_MODEL.md](./THREAT_MODEL.md). Reporters and triagers should consult that document alongside this policy.
