Skip to content

docs(security): add SECURITY.md with coordinated disclosure guidance #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
donny-devops wants to merge 1 commit into from
Closed

docs(security): add SECURITY.md with coordinated disclosure guidance #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 51 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
# Security Policy

## Scope

This repository is a **demo-safe reference studio** for exploring post-quantum cryptography workflows. It does **not** implement production-grade ML-KEM, ML-DSA, or SLH-DSA primitives. The crypto abstraction layer is intentionally isolated so a vetted provider can replace the demo provider without rewriting the UI.

Despite its demo-safe posture, the project is security-adjacent and we take coordinated disclosure seriously.

## Supported Versions

| Version | Supported |
| ------- | --------- |
| main | Yes |
| < 0.1.0 | No |

## Reporting a Vulnerability

Please **do not** open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via GitHub's built-in private vulnerability reporting:

1. Go to the **Security** tab of this repository.
2. Click **Report a vulnerability**.
3. Fill in the details and submit.

Alternatively, you may email the maintainer directly. Include:

@gemini-code-assist gemini-code-assist Bot Jun 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The policy mentions the option to email the maintainer directly, but no email address or contact link is provided. Please add the maintainer's email address.

Suggested change
Alternatively, you may email the maintainer directly. Include:
Alternatively, you may email the maintainer directly at security@example.com. Include:

@amazon-q-developer amazon-q-developer Bot Jun 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Missing Critical Information: Add the maintainer's email address. The alternative reporting method instructs users to email the maintainer directly but provides no contact information, breaking this vulnerability reporting pathway.

Suggested change
Alternatively, you may email the maintainer directly. Include:
Alternatively, you may email the maintainer directly at [security@example.com]. Include:

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Provide a concrete email address for private reports

When GitHub private vulnerability reporting is disabled or unavailable to a reporter, this fallback path is not actionable because it tells reporters to email the maintainer but provides no address or other contact; I checked the repo for contact/email references and only this new SECURITY.md mentions one. Please include a concrete security contact or remove the unusable fallback so vulnerability reports can still be sent privately.

Useful? React with 👍 / 👎.


- A clear description of the vulnerability and its potential impact
- Steps to reproduce or a proof-of-concept
- Any suggested mitigations

We will acknowledge receipt within **72 hours** and aim to provide a remediation timeline within **7 days**.

## Disclosure Policy

- We follow a **coordinated disclosure** model.
- Please allow us reasonable time to investigate and remediate before public disclosure.
- We will credit reporters in the release notes unless anonymity is requested.

## Out of Scope

- Vulnerabilities in demo/simulation crypto stubs that have no production impact
- Issues in third-party dependencies already tracked by Dependabot
- UI cosmetic issues

## Security Roadmap

Upcoming security improvements tracked against the release roadmap:

- **v0.2.0** — SBOM generation, dependency scanning, stronger provider contracts, and security disclosure/process documentation
- **v0.3.0** — Vetted provider integration behind `KemProvider`, benchmark harness, and migration-readiness guidance