# Security

## Supported versions

Only the most recent version of chezmoi is supported with security updates.

## Virus scanner false positives

Virus scanning software, especially on Windows machines, occasionally report
viruses or trojans in the chezmoi binary. This is almost certainly a false
positive.

For more information see [Why does my virus-scanning software think my Go
distribution or compiled binary is infected?](https://go.dev/doc/faq#virus) in
the Go FAQ.

## Reporting a vulnerability

Please report vulnerabilities by [opening a GitHub
issue](https://github.com/twpayne/chezmoi/issues/new/choose) or sending an
email to
[`twpayne+chezmoi-security@gmail.com`](mailto:twpayne%2Bchezmoi-security@gmail.com).
