If you discover a security vulnerability in Aegis, please report it responsibly.

1. Do NOT create a public GitHub issue for security vulnerabilities
2. Use GitHub private vulnerability reporting (Security → Report a vulnerability); if you cannot use it, contact the maintainers directly and mark the message confidential
3. Include the following information:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Any suggested fixes (optional)

• Acknowledgment of your report within 48 hours
• Regular updates on the progress
• Credit for the discovery (unless you prefer to remain anonymous)

Security issues in the following are in scope:

• Core scanning engine vulnerabilities
• Path traversal vulnerabilities
• Pattern bypass vulnerabilities
• Denial of service issues
• Secret exfiltration concerns

When using Aegis:

• Run scans in isolated environments
• Review suppressions carefully - they disable security checks
• Keep patterns updated via aegis update
• Use baseline files to track known issues