We take security seriously. If you discover a security vulnerability, please:

DO NOT file a public issue.

DO email us at: security@ccoh.io

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes

We will respond within 48 hours and work to resolve the issue promptly.

When contributing code, please ensure:

• No hardcoded secrets or credentials
• Input validation on all user inputs
• SQL injection prevention (use parameterized queries)
• XSS protection
• CSRF protection where applicable

This tool handles cloud credentials. We recommend:

• Running CCOH in a private network
• Using IAM roles instead of access keys when possible
• Encrypting credentials at rest
• Regular security audits