The DHIS2 security team handles security issues in Chap and participates in responsible disclosure. This policy applies to every repository in the dhis2-chap organization that does not have its own SECURITY.md. It follows the DHIS2 Vulnerability Reporting & Disclosure Policy, which takes precedence where the two differ.

Do not report security issues through public GitHub issues, pull requests, Jira, or the community forum.

• GitHub (preferred): Open a private report from the affected repository's Security tab using "Report a vulnerability".
• Email: Use security@dhis2.org if you do not have a GitHub account, if private reporting is not enabled on the repository, or if the issue spans more than one repository.

Please include:

• The affected repository and Chap version
• A description of the issue and its impact
• Steps to reproduce (a proof of concept is welcome)
• Whether you would like to be credited (YES / NO)

Reports written in English are preferred. We aim to acknowledge reports within 10 working days.

Security fixes are made for the latest release only.

Please give us reasonable time to fix an issue before disclosing it, do not include sensitive or personal data in any disclosure, and test only against your own instances, not against deployments operated by others.

Contact: mailto:security@dhis2.org
Preferred-Languages: en
Policy: https://dhis2.org/trust/vulnerability-policy