feat: comprehensive vulnerability disclosure program for NOYD PQC ecosystem

.github/ISSUE_TEMPLATE/security_bug_report.yml

@@ -0,0 +1,321 @@
+name: 🛡️ Security Bug Report
+description: Report a security vulnerability in the NOYD ecosystem
+title: "[SECURITY] "
+labels: ["security", "needs-triage"]
+assignees: []
+contact_links:
+  - name: Private Security Reporting
+    url: https://github.com/noyddev/noyd-public-sdk/security/advisories/new
+  - name: Security Email
+    url: mailto:security@noyd.dev
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## ⚠️ IMPORTANT: Private Reporting
+
+        **If your report contains sensitive information or an active exploit, DO NOT use this form.**
+
+        Instead, report privately through:
+        - [GitHub Private Security Advisories](https://github.com/noyddev/noyd-public-sdk/security/advisories/new) (Preferred)
+        - Encrypted email: `security@noyd.dev` (PGP key available on keybase.io/noyd)
+
+        This form is for non-critical security issues that can be discussed publicly.
+
+        ---
+
+        ## Vulnerability Report
+
+        Thank you for helping secure the NOYD ecosystem! Please provide as much detail
+        as possible to help us understand and reproduce the issue.
+
+  - type: dropdown
+    id: vulnerability-type
+    attributes:
+      label: Vulnerability Type
+      description: Select the primary type of vulnerability
+      options:
+        - Select a type...
+        - Buffer Overflow / Memory Safety
+        - Cryptographic Vulnerability (ML-KEM-768 / ML-DSA-65)
+        - Authentication/Authorization Bypass
+        - Race Condition / Concurrency Issue
+        - Session Management Vulnerability
+        - Input Validation / Injection
+        - Information Disclosure
+        - Denial of Service
+        - Protocol/State Machine Flaw
+        - Other Security Issue
+    validations:
+      required: true
+
+  - type: input
+    id: cve-id
+    attributes:
+      label: CVE ID (if assigned)
+      description: If this vulnerability has been assigned a CVE, enter the ID
+      placeholder: "e.g., CVE-2024-XXXXX"
+    validations:
+      required: false
+
+  - type: textarea
+    id: cvss-vector
+    attributes:
+      label: CVSS v3.1 Vector
+      description: |
+        Provide the CVSS 3.1 vector string for this vulnerability.
+        Calculate at: https://www.first.org/cvss/calculator/3.1
+      placeholder: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    validations:
+      required: true
+
+  - type: input
+    id: cvss-score
+    attributes:
+      label: CVSS Score (0.0 - 10.0)
+      description: Numeric score from the CVSS calculator
+      placeholder: "e.g., 9.8"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity Level
+      description: Based on CVSS score
+      options:
+        - Select severity...
+        - Critical (9.0 - 10.0)
+        - High (7.0 - 8.9)
+        - Medium (4.0 - 6.9)
+        - Low (0.1 - 3.9)
+        - None (0.0)
+    validations:
+      required: true
+
+  - type: textarea
+    id: component
+    attributes:
+      label: Affected Component
+      description: |
+        Specify which component is affected:
+        - SDK version/commit hash
+        - Endpoint (if applicable)
+        - Specific function or module
+      placeholder: |
+        Examples:
+        - github.com/noyddev/noyd-public-sdk v1.2.3
+        - noyd-public-sdk.onrender.com/health
+        - tools/fuzz_test.go:parseMLKEM768Ciphertext
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Vulnerability Description
+      description: Detailed description of the vulnerability and its impact
+      placeholder: |
+        Describe what the vulnerability is, how it can be exploited, and what
+        an attacker could achieve if exploited. Be specific about preconditions
+        and attack requirements.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps-to-reproduce
+    attributes:
+      label: Steps to Reproduce
+      description: |
+        Provide step-by-step instructions to reproduce the vulnerability.
+        Include specific inputs, commands, and expected vs actual behavior.
+      placeholder: |
+        1. Environment: Go 1.22, macOS Sonoma, SDK commit abc123...
+        2. Run: go run ./tools/fuzz_test.go -seed=12345
+        3. Observe: Buffer overflow in parseMLKEM768Ciphertext at line 123
+        4. Expected: Function should reject malformed input
+        5. Actual: Silently reads beyond buffer boundary
+    validations:
+      required: true
+
+  - type: textarea
+    id: proof-of-concept
+    attributes:
+      label: Proof of Concept (PoC)
+      description: |
+        Provide a minimal PoC that demonstrates the vulnerability.
+        This should be executable and demonstrate the issue without being
+        exploitative. Remove any sensitive information.
+      placeholder: |
+        ```go
+        // Minimal PoC demonstrating the vulnerability
+        func main() {
+            // Create malformed input
+            data := make([]byte, 100) // Too short!
+            // ... populate with specific bytes ...
+
+            // This will trigger the overflow
+            result := parseMLKEM768Ciphertext(data)
+            fmt.Println(result)
+        }
+        ```
+
+        Or provide a specific hex payload:
+        ```
+        0000: 4e 4f 59 44 2d 4d 4c 4b 45 4d 37 36  // NOYD-MLKEM768 (valid domain)
+        0012: 00 01 02 03 ...                        // seed
+        0044: [truncated - only 56 bytes instead of 1184]
+        ```
+    validations:
+      required: true
+
+  - type: textarea
+    id: impact
+    attributes:
+      label: Impact Assessment
+      description: |
+        Describe the security impact of this vulnerability.
+        What can an attacker achieve? What data is at risk?
+        What is the worst-case scenario?
+      placeholder: |
+        - Impact Type: [Remote Code Execution / Data Exfiltration / etc.]
+        - Attack Complexity: [Low/High - what conditions must be met?]
+        - Privileges Required: [None/Low/High]
+        - User Interaction: [Required/Not Required]
+        - Confidentiality Impact: [High/Medium/Low/None]
+        - Integrity Impact: [High/Medium/Low/None]
+        - Availability Impact: [High/Medium/Low/None]
+    validations:
+      required: true
+
+  - type: textarea
+    id: remediation
+    attributes:
+      label: Suggested Remediation
+      description: |
+        If you have a suggested fix, provide it here. This is optional but
+        helps us address issues faster.
+      placeholder: |
+        Suggested fix:
+        ```go
+        func parseMLKEM768Ciphertext(data []byte) error {
+            if len(data) < MLKEM768CiphertextSize {
+                return fmt.Errorf("data too short: %d < %d", len(data), MLKEM768CiphertextSize)
+            }
+            // ... rest of function ...
+        }
+        ```
+    validations:
+      required: false
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment Details
+      description: |
+        Provide details about the testing environment
+      placeholder: |
+        - Go Version: 1.22
+        - OS: Linux (Ubuntu 22.04)
+        - SDK Version: v1.2.3 / Commit: abc123def
+        - Build Flags: CGO_ENABLED=1
+        - Dependencies: golang.org/x/crypto v0.17.0
+    validations:
+      required: true
+
+  - type: textarea
+    id: timeline
+    attributes:
+      label: Disclosure Timeline
+      description: |
+        Confirm your intended disclosure timeline.
+        We request 90 days from acknowledgment before public disclosure.
+      placeholder: |
+        - Date of Discovery: YYYY-MM-DD
+        - Initial Report to NOYD: YYYY-MM-DD
+        - Requested Disclosure Date: YYYY-MM-DD (minimum 90 days from report)
+        - Any intermediate milestones or constraints?
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Any other relevant information, references, or questions
+      placeholder: |
+        - Related vulnerabilities: CVE-2024-XXXXX, GHSA-xxxx
+        - References: https://example.com/security-advisory
+        - Questions: ...
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: agreements
+    attributes:
+      label: Agreements and Acknowledgments
+      options:
+        - label: I have verified this is a genuine security vulnerability and not a false positive
+          required: true
+        - label: I have not exploited this vulnerability beyond demonstration purposes
+          required: true
+        - label: I agree to coordinated disclosure and will not publish details before 90 days after initial report
+          required: true
+        - label: I understand that submitting false or exaggerated reports may result in disqualification from the program
+          required: true
+        - label: I am authorized to report this vulnerability (i.e., it is not on company time or violates employment agreements)
+          required: true
+
+  - type: input
+    id: researcher-name
+    attributes:
+      label: Researcher Name/Handle
+      description: How you would like to be credited in our Hall of Fame (leave blank for anonymous)
+      placeholder: "e.g., @yourhandle or 'Anonymous'"
+    validations:
+      required: false
+
+  - type: input
+    id: researcher-link
+    attributes:
+      label: Link to Researcher Profile (optional)
+      description: GitHub profile, Twitter, or website for recognition
+      placeholder: "https://github.com/yourhandle"
+    validations:
+      required: false
+
+  - type: input
+    id: contact-email
+    attributes:
+      label: Contact Email (optional)
+      description: For follow-up questions. Will not be displayed publicly.
+      placeholder: "researcher@example.com"
+    validations:
+      required: false
+
+  - type: markdown
+    attributes:
+      value: |
+        ---
+
+        ## 📋 Submission Checklist
+
+        - [ ] Vulnerability type selected
+        - [ ] CVSS vector provided (calculate at https://www.first.org/cvss/calculator/3.1)
+        - [ ] Affected component specified with version/commit
+        - [ ] Detailed description written
+        - [ ] Steps to reproduce provided
+        - [ ] Proof of concept attached or embedded
+        - [ ] Impact assessment completed
+        - [ ] Environment details provided
+        - [ ] All agreements checked
+        - [ ] Private issue created if sensitive (preferred)
+
+        ## 🛡️ Recognition
+
+        Upon successful remediation, you will be:
+        - Listed in our [Hall of Fame](https://github.com/noyddev/noyd-vulnerability-program/blob/main/HALL_OF_FAME.md)
+        - Eligible for financial rewards per our [reward structure](https://github.com/noyddev/noyd-vulnerability-program#-reward-structure)
+        - Credited in security advisories and release notes
+
+        **Thank you for helping keep NOYD secure!** 🔐