`SECURITY.md`

34 lines
# Security Policy

## Reporting a Vulnerability

If you discover a vulnerability or sensitive-data exposure risk, open a GitHub issue with:
- A minimal reproduction
- The file path(s) involved
- Any suggested mitigation

Do NOT post secrets in issues.

## Sensitive Information (Never Commit)

- API keys, tokens, credentials
- `.env` files
- Private URLs with embedded credentials
- Real customer data or identifiers
- Internal system screenshots
- Vendor/client names or contractual terms

## If Something Sensitive Is Committed

1. **Rotate** compromised credentials immediately
2. **Rewrite** git history to remove the secret (`git filter-repo`)
3. **Force push** and coordinate with anyone who cloned
4. Follow hosting provider guidance to purge caches/forks

## Security Controls

- GitHub Secret Scanning: **enabled**
- Push Protection: **enabled**
- Pre-commit checks: `snippets/precommit.sh`
- Redaction linter: `snippets/redact_lint.py`