We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email security concerns to the maintainers. You can find contact information in the repository's profile or reach out via GitHub's private vulnerability reporting feature if available.

When reporting a vulnerability, please include:

1. Description: A clear description of the vulnerability
2. Steps to Reproduce: Detailed steps to reproduce the issue
3. Impact Assessment: Your assessment of the potential impact
4. Affected Versions: Which versions are affected (if known)
5. Suggested Fix: Any suggestions for remediation (optional)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution Timeline:
  • Critical: Target fix within 7 days
  • High: Target fix within 30 days
  • Medium/Low: Target fix within 90 days

1. Acknowledgment: We'll acknowledge receipt of your report
2. Investigation: We'll investigate and validate the vulnerability
3. Resolution: We'll work on a fix and coordinate disclosure
4. Credit: We'll credit you in the release notes (unless you prefer anonymity)

This project employs several security measures:

• CodeQL: Static analysis for security vulnerabilities
• Trivy: Vulnerability scanning for dependencies
• Dependabot: Automated dependency updates

• All code changes require pull request review
• CI/CD pipelines run security scans on every PR
• Dependencies are regularly updated
• Strict linting with zero-tolerance for issues

This security policy applies to:

• The confvis CLI tool
• All official confvis source integrations
• Documentation and examples

Out of scope:

• Third-party integrations not maintained by this project
• Issues in upstream dependencies (please report these to the relevant projects)

We appreciate the security researchers who help keep confvis secure. Contributors will be acknowledged here (with permission).