# Maintenance policy Pain001 is free open-source software maintained in a personal capacity. This page says what to expect from it. It is a statement of intent, not a contract: there is no paid tier, no service level agreement (SLA) and no out-of-hours cover. ## Releases - Releases move one step at a time on the `0.0.x` line, as described in [`RELEASING.md`](https://github.com/sebastienrousseau/pain001/blob/main/RELEASING.md). Each release is a signed tag with build provenance, attestations, an SBOM and SHA-256 checksums of every asset; [verify a release](evidence/verify-a-release.md) shows how to check them. - The [support table in `SUPPORT.md`](https://github.com/sebastienrousseau/pain001/blob/main/SUPPORT.md) lists the versions that currently receive fixes. ## Long-term support - There is no long-term support (LTS) line at present. - Fixes, including security fixes, ship in the next release; you get them by upgrading. Earlier releases are not patched. - If an LTS line is offered later, this page will name the release and how long it is supported before that applies. ## Security reports - Report vulnerabilities privately, as [`SECURITY.md`](https://github.com/sebastienrousseau/pain001/blob/main/SECURITY.md) describes. - The goal is to acknowledge a report within 5 working days. This is a goal, not a guarantee. ## What this policy does not offer - No SLA, no guaranteed response or fix times, no out-of-hours cover. - No paid support, sponsorship or partner programme. Pain001's licence lets any firm support it commercially; the project has no commercial partners and takes no fees or referrals. - No certification. Pain001 publishes evidence (see [Evidence for reviewers](evidence/index.md)); it does not claim compliance with any regulation or standard.