16 lines
1015 B
Markdown
16 lines
1015 B
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public issue for a vulnerability that could expose credentials, sensitive artifacts, repository access, or a practical bypass of a security invariant. Use the private contact channel published by the dTech Technology and Research Initiative and include the affected version, reproduction steps, impact, and a safe proof of concept.
|
|
|
|
Do not include live credentials, personal data, proprietary artifacts, or weaponized payloads. Maintainers will acknowledge a complete report, coordinate validation and remediation, and publish a disclosure when affected users can act safely.
|
|
|
|
## Supported versions
|
|
|
|
The project is pre-alpha. Security fixes target the latest `main` revision until the first tagged release policy is published.
|
|
|
|
## Safe-use notice
|
|
|
|
AAISA findings require human review. A clean report does not establish that a system is secure. Generated reports may disclose file paths and security context and should be stored and shared accordingly.
|