waldiez-swid is a cryptographic identity library. We take security reports seriously and appreciate responsible disclosure.

Please do not open a public issue for a security vulnerability.

Report privately, by either channel:

• GitHub private vulnerability reporting (preferred) — Security → Report a vulnerability (https://github.com/waldiez/swid/security/advisories/new); or
• email — security@waldiez.io.

Please include:

• affected version / commit,
• a description and impact assessment,
• reproduction steps or a proof-of-concept, and
• any suggested remediation.

We aim to acknowledge a report within 10 business days and to agree a disclosure timeline with you. Please allow us reasonable time to release a fix before any public disclosure.

In scope — issues in this repository, especially in the trust-critical paths:

• CEL verification (swid/cel.py) — signature checks, previousEvent chaining, SCID binding, controller succession, terminal deactivation, the type↔payload binding of the unsigned event envelope;
• the SCID / DID codec (swid/scid.py) and document validation (swid/document.py);
• key handling and the keystore backends (swid/keystore/);
• the reference server (swid_server/), e.g. the SSRF-guarded HSTP fetch and the request-size / TOCTOU protections.

Out of scope:

• the SWF specification text itself — report spec issues to the Spatial Web Foundation repositories (see SPECIFICATIONS.md);
• vulnerabilities in third-party dependencies (report those upstream; we track them via pip-audit).

Verifiers in this library are contracted to never crash on untrusted input — they return False or raise ValueError, never an unexpected exception. This is enforced by the fuzz harness (make fuzz). A crash on malformed input is itself considered a security issue; please report it.