The following table lists which versions of MochaJSON are currently being supported with security updates.

We recommend always using the latest stable release available on Maven Central to receive the newest security fixes and performance improvements.

If you discover a security vulnerability in MochaJSON, please follow these steps:

1. Do not create a public GitHub issue.
2. Privately email the maintainers at:
   📧 mochaapi@example.com
3. Provide a clear description of:
   • The nature of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

You can expect:

• An acknowledgment within 48 hours
• A response and triage within 7 days
• A coordinated disclosure plan if the issue is confirmed

We ask that all security researchers follow responsible disclosure practices:

• Do not exploit or publicly share vulnerabilities before they are fixed.
• We will credit security reporters who help improve MochaJSON in our release notes (with permission).

To use MochaJSON securely:

• Always update to the latest version.
• Avoid using reflection-based or unsafe parsing modes (if added in future versions).
• Validate network input before passing it to MochaJSON parsers.

• ✅ GitHub Dependabot security alerts enabled
• ✅ GitHub CodeQL Analysis workflow enabled
• 🔄 Regular review of external dependencies
• 🧪 Continuous integration with Gradle vulnerability scan

For urgent or sensitive matters:
MochaAPI Team — Lead Maintainers
📧 guptavishal998.pa@gmail.com
🌐 https://github.com/MochaAPI/MochaJSON

Thank you for helping keep MochaJSON safe and secure for everyone.