Security is a first-class engineering concern for People Utility Token (PUT).

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Use the official security contact published by People Utility Token.

If the project has not yet published a dedicated security email, contact the project administrators through an official PUT channel and request the private security-reporting route.

Where safe, provide:

• A clear description of the vulnerability
• Affected repository, component, or version
• Reproduction steps or proof of concept
• Potential impact
• Suggested remediation, if known

Please avoid sending real user data, private keys, seed phrases, passwords, or other secrets in a report.

If a credential or secret is committed accidentally:

1. Treat it as compromised immediately.
2. Revoke or rotate it.
3. Review relevant access logs.
4. Remove the secret from the active codebase.
5. Use repository history rewriting only when appropriate and coordinated with maintainers.

Deleting a secret from the latest commit does not make an exposed credential safe.

Security expectations apply to source code, CI/CD, application infrastructure, APIs, dependencies, authentication, data handling, and blockchain integrations maintained by PUT.