This repository is a governed strategic asset system for funnelplugs.com.
Security includes both technical integrity and governance integrity.
For the full operating doctrine, see docs/SECURITY_POLICY.md.
Security coverage applies to:
- repository source and workflow automation
- generated static output and deployment pipeline
- governance files that control quality, publishing, and trust posture
If you discover a security issue, do not open a public issue.
Report privately with:
- affected file(s) or workflow path(s)
- reproduction steps
- impact assessment
- suggested remediation (if available)
Primary channel: repository security advisory (preferred). Fallback channel: private maintainer contact.
- initial acknowledgement: within 72 hours
- triage decision: within 7 calendar days
- remediation target: based on severity and blast radius
Please allow time for triage and remediation before public disclosure. We will coordinate publication timing after a fix is available.
Good-faith research and responsible disclosure are welcomed. Do not perform destructive tests, privacy-invasive actions, or service disruption.