GhimTech Tax handles Social Security numbers, wage records, and bank account details. A defect in this software can expose a taxpayer to identity theft or financial loss, so security reports are treated as the highest-priority class of issue we receive.

Do not open a public issue. A public report tells everyone about the problem before anyone can fix it.

Report privately through GitHub's private vulnerability reporting, which opens a channel visible only to the maintainers.

Please include what you can:

• What the issue is and what an attacker could do with it
• The steps to reproduce it, or a proof of concept
• The affected route, package, or file
• Anything you already know about the blast radius

You will get an acknowledgement that a human has read the report, followed by an assessment and a plan. If a report turns out not to be a security issue, we will say so and explain why rather than letting it go quiet.

Please do not include real taxpayer data in a report. If reproducing an issue requires a return, use synthetic values — identification numbers in the 4xx-xx-xxxx range and invented names. If you believe you have encountered real taxpayer data through a defect, say so and describe it without copying it.

In scope: anything in this repository — the web application, the tax engine, build and deployment configuration.

Particularly interested in:

• Authorization gaps, especially any path where one practice can reach another's returns or documents, or where a client-portal session can reach staff surfaces
• Anywhere a taxpayer identification number, bank account number, or source document is rendered, logged, cached, or transmitted unmasked
• Injection into any surface that reaches storage, the document pipeline, or a generated PDF
• Session handling, multi-factor enrolment, and the electronic authorization and signature flow
• Provider credential storage and the e-file transmission path
• Dependency vulnerabilities with a demonstrated path to exploitation here

Out of scope: reports generated by an automated scanner with no demonstrated impact, missing headers with no exploitable consequence, social engineering, and denial of service through volume.

Research conducted in good faith under this policy is authorised, and we will not pursue action over it. Please stay within scope, use only accounts and data you own or that were provisioned for testing, avoid degrading service for others, and do not access, modify, or retain data belonging to anyone else. If you encounter someone else's data, stop and report it.

• Taxpayer identification numbers are masked to ***-**-6789 at the presentation layer, and an end-to-end test asserts that no unmasked identifier renders on any authenticated route.
• Credentials, signing material, and taxpayer records are excluded from version control by policy and by .gitignore, and a public repository is treated as public forever.
• Security headers travel with the application rather than being set at the hosting layer, so no environment is one console change away from being framed by a third party.