Security

Security

Report a vulnerability

Use private vulnerability reporting. Do not open a public issue. Details and what to include: SECURITY.md and CONTRIBUTING.md. Use synthetic fixtures only.

Design baseline

• docs/12-security-and-audit.md: threat model, audit trail, integrity, data protection.
• docs/07-authorization-model.md: hybrid RBAC + ABAC, deny by default, deny always wins.
• The decisions register holds binding resolutions. R61 covers site data and must never be broken.

Operator procedures

Key rotation · Blob integrity verification · External audit verification · WORM bucket prerequisite

Repository controls

See CI, merge gate and releases and the security settings table in the GitHub setup runbook. Open security work is on the board under the security label.