Responsible disclosure guidelines for security vulnerabilities in SIGIL.

Do NOT file public issues for security vulnerabilities.

Public disclosure of security vulnerabilities puts all SIGIL users at risk. Instead, follow our responsible disclosure process.

Send your report to: security@sigil.sh

PGP Key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: Sigil Security v1.0

[Full PGP key would be here in production]

-----END PGP PUBLIC KEY BLOCK-----

💡 Tip: Encrypt sensitive reports with our PGP key to protect vulnerability details during transmission.

1. Go to GitHub Security Advisory
2. Click "Report a vulnerability"
3. Fill in the form with details
4. GitHub will privately share the report with maintainers

Your report should include:

1. Description: What is the vulnerability?
2. Impact: What is the security impact?
3. Reproduction: Steps to reproduce the issue
4. Proof of Concept: Code or commands demonstrating the vulnerability
5. Suggested Fix: (Optional) How you think it should be fixed
6. Affected Versions: Which versions are affected?

We classify vulnerabilities using CVSS v3.1:

1. Receipt: We acknowledge your report within 48 hours
2. Validation: We reproduce and validate the vulnerability
3. Fix Development: We develop a fix (timeline depends on severity)
4. Coordination: We coordinate release with you
5. Public Disclosure: We publish the advisory after the fix is released

• We'll work with you to set a disclosure date
• You'll be credited in the advisory (unless you prefer to remain anonymous)
• We'll publish the advisory after the fix is available

SIGIL commits to:

• No legal action against researchers who follow this policy
• Credit for valid vulnerability reports
• Communication throughout the disclosure process
• Protection of your identity (if requested)

• ❌ Don't file public issues for security vulnerabilities
• ❌ Don't disclose vulnerabilities publicly before coordination
• ❌ Don't exploit vulnerabilities for any purpose other than testing
• ❌ Don't access or modify user data without permission

SIGIL does not currently offer a bug bounty program. However, we recognize valuable security research through:

• Credits in security advisories
• Acknowledgments in release notes
• Invitations to contribute to security improvements

For general security questions (not vulnerability reports):

• Email: security@sigil.sh
• Discussions: GitHub Security Discussions

⚠️ Warning: For vulnerability reports, use the private reporting methods above. Do not use public discussions.

• Contributing Guide — Development practices
• Security Best Practices — How SIGIL protects secrets
• Audit Log — SIGIL's internal security logging

SIGIL maintains an audit log of all secret access attempts. This log is:

• Append-only: Cannot be modified or deleted
• Encrypted: Protected at rest
• Tamper-evident: Hash chain ensures integrity
• Monitored: Alerts on suspicious activity

💡 Tip: Regular review of the audit log (~/.sigil/vault/audit.jsonl) is recommended for security-sensitive deployments.

Security researchers help make SIGIL safer for everyone. We appreciate your responsible disclosure!