GovPeer is a security tool, so we take vulnerability reports seriously.

Please do not open a public issue for security problems.

Instead, use one of:

• GitHub's private vulnerability reporting: https://github.com/schmug/govpeer/security/advisories/new
• Email: thebreakawayguy@gmail.com (subject line: GovPeer security)

Please include:

• A description of the issue and the impact you believe it has
• Steps to reproduce (proof-of-concept welcome)
• The commit / version you tested against
• Any suggested mitigation

We aim to acknowledge reports within 3 business days and to provide a fix or mitigation plan within 30 days for confirmed vulnerabilities.

In scope:

• The Sensor and Aggregator services in this repository
• Federation sync and trust-ledger logic in govpeer/common
• Authentication, signing, and verification (pynacl, JWT) flows
• The Sensor / Aggregator / Vendor Portal UIs

Out of scope:

• Third-party dependencies (please report upstream; we will track via Dependabot)
• Issues that require physical access to a sensor host
• Denial-of-service caused by misconfiguring rate limits or scan budgets
• Findings against demo data or seeded fixtures

We support coordinated disclosure. If you'd like credit in a release note or advisory, mention how you'd like to be acknowledged in your report.