Do not open a public GitHub Issue for security vulnerabilities.

Please report security issues via private disclosure:

• Email: security@faultray.com
• Subject: [SECURITY] Brief description
• GPG key: Available at https://faultray.com/.well-known/security.txt (planned)

1. Description of the vulnerability
2. Steps to reproduce (proof-of-concept if available)
3. Potential impact
4. Any suggested mitigations

For vulnerabilities that qualify as CVEs:

1. We will request a CVE ID via MITRE or coordinate with the reporter
2. A GitHub Security Advisory will be published
3. A patch release will be tagged and pushed to PyPI/npm simultaneously
4. Credit will be given to the reporter (unless they prefer anonymity)

• All API routes require Supabase JWT authentication
• Row Level Security (RLS) enabled on all Supabase tables
• Stripe webhook signatures verified on /api/webhooks/stripe
• Content Security Policy headers set via next.config.ts
• Rate limiting: 60 req/min per IP on simulation endpoints
• No secrets in client-side bundles — all keys in environment variables

Dependencies are monitored via:

• npm audit — run in CI on every PR
• Dependabot alerts (planned — see LICENSE-02)

There is currently no formal monetary bug bounty program. However, responsible disclosure is actively encouraged and recognized:

• Hall of Fame: Reporters who disclose valid vulnerabilities are credited in our CHANGELOG.md and on our website (unless anonymity is requested)
• Priority support: Access to a dedicated support channel for researchers during the disclosure period
• Future program: A formal monetary bug bounty program is planned for 2026. Researchers who disclose before launch will be grandfathered in

In scope: Authentication bypasses, RLS policy violations, SSRF, injection attacks, data exposure via API Out of scope: Denial of service, rate limit bypass (already mitigated), brute force on non-production systems

Report to: security@faultray.com