If you find a vulnerability in the analyzer scripts, the ruleset, or the validator templates, report it privately.

• Email: cambamwham2@gmail.com
• PGP: available on request
• Response target: 5 business days for initial acknowledgement

Please do not open a public issue for security problems in this repository.

If the analyzer surfaces a bug in a downstream open-source project, follow that project's own policy. This repository's disclosure templates (validator/templates/) exist to help with that workflow; they do not replace the target project's SECURITY.md.

Do not open a public PR or issue against the target project until the maintainers have acknowledged the report.

In scope for reports against this repo:

• Rules with false positives that materially degrade signal
• Rules with false negatives against a documented pattern
• Scanner orchestration bugs that skip findings or corrupt output
• Secrets or credentials in the repo

Out of scope:

• Findings against the upstream tools this project drives (Semgrep, Trivy, Grype, Gitleaks) - report those to their respective projects
• Findings against sample code intentionally shipped as vulnerable (currently: none)