Security Reporting

We take security seriously. This guide covers reporting vulnerabilities responsibly.

Responsible Disclosure

Our Commitment

• We respond quickly to security reports
• We don't pursue researchers who follow guidelines
• We credit researchers (with permission)

Timeline

What to Report

In Scope

• Authentication bypass
• Authorization flaws
• Data exposure
• Cryptographic weaknesses
• Injection attacks
• Service disruption

Out of Scope

• Social engineering
• Physical security
• Denial of service (basic)
• Issues in third-party dependencies

How to Report

Contact

Email: [email protected]

Format

Subject: [SECURITY] Brief Description

Vulnerability Type:
Severity (Critical/High/Medium/Low):
Affected Component:
Steps to Reproduce:
Impact:
Suggested Fix (optional):

Example

Subject: [SECURITY] SQL Injection in /api/will

Vulnerability Type: SQL Injection
Severity: Critical
Affected Component: api/internal/handler/will.go
Steps to Reproduce:
  1. POST /api/will/upload
  2. Inject SQL in filename parameter
Impact: Database compromise

What Not to Do

• Don't exploit the vulnerability
• Don't access other user data
• Don't modify systems
• Don't share with third parties
• Don't publish without coordination

What Happens Next

1. Acknowledge - We confirm receipt
2. Assess - We determine severity
3. Fix - We develop and test
4. Release - We publish fix
5. Credit - We acknowledge researcher

Severity Levels

Critical (P0)

• Data breach
• Account takeover
• Full system compromise

Fix Timeline: 24-48 hours (workaround), 7 days (fix)

High (P1)

• Partial data exposure
• Authentication bypass
• Privilege escalation

Fix Timeline: 7 days (workaround), 14 days (fix)

Medium (P2)

• Limited impact
• Requires specific conditions
• Moderate data exposure

Fix Timeline: 30 days

Low (P3)

• Minimal impact
• Difficult to exploit
• Informational

Fix Timeline: Next release

Security Updates

Release Notes

Security fixes documented in:

• GitHub releases
• CHANGELOG.md

Credit

With permission, we credit researchers:

• Name in release notes
• Thanks in documentation

Example:

Thanks to Jane Doe for reporting this issue.

Bug Bounty

Currently no bug bounty program. We appreciate responsible disclosure.

Secure Coding

See Code Style for security guidelines.

Encryption

BAP uses:

• AES-256-GCM for documents
• Argon2id for passwords
• HKDF for key derivation
• Shamir's Secret Sharing

Contact

Security issues only: [email protected]

General issues: GitHub Issues

Next Steps

• Code Style — Secure coding
• Pull Requests — Contribution workflow
• Development Setup — Local setup