Thank you for helping keep the ATLAS Framework secure.

Security is considered a fundamental quality attribute of the project. It is integrated into the architecture, development process, and release workflow from the beginning.

Security updates are provided for supported development branches only.

Only the latest release within each supported channel receives security fixes.

If you discover a potential security vulnerability, please report it responsibly.

Please do not disclose security vulnerabilities publicly before they have been investigated and resolved.

Instead, contact the project maintainers with:

• A description of the issue
• Steps to reproduce
• Affected version(s)
• Potential impact
• Suggested mitigation (if available)

Responsible disclosure helps protect all users of the project.

The ATLAS project follows a coordinated disclosure process.

The general workflow is:

1. Vulnerability report received.
2. Initial assessment.
3. Verification and reproduction.
4. Development of a fix.
5. Internal validation and testing.
6. Security release (if required).
7. Public disclosure after the fix is available.

Security reports are handled confidentially whenever possible.

Every reported issue is evaluated according to:

• Severity
• Impact
• Reproducibility
• Scope
• Affected components

The project aims to acknowledge security reports promptly and provide regular updates during the investigation process.

Security begins with architecture.

ATLAS follows several architectural principles that reduce security risks:

• Strong typing
• Explicit APIs
• Small public surface area
• Clear package boundaries
• Layered architecture
• Dependency validation
• Encapsulation of internal implementation
• Principle of least privilege where applicable

Good architecture is the first line of defense.

Third-party dependencies are reviewed regularly.

Contributors should:

• Prefer well-maintained dependencies.
• Avoid unnecessary packages.
• Keep dependencies up to date.
• Remove unused dependencies.
• Evaluate security implications before introducing new packages.

Minimizing dependencies reduces long-term maintenance and security risks.

Contributors are encouraged to:

• Validate input.
• Handle errors safely.
• Avoid exposing internal implementation details.
• Write defensive code.
• Keep public APIs intentionally small.
• Include tests for security-relevant behavior when appropriate.

Security is part of everyday development—not a final review step.

Before every official release, the following quality gates should be satisfied:

• Successful build
• Successful test suite
• Architecture validation
• Dependency review
• Documentation review
• Release validation

A release should never compromise architectural or security principles.

Not every unexpected behavior is a security issue.

Bug reports and security reports should be distinguished whenever possible.

If uncertain, contributors are encouraged to report the issue. It can then be classified appropriately.

When contributing to ATLAS:

• Never commit secrets or credentials.
• Avoid hard-coded sensitive values.
• Review dependency changes carefully.
• Prefer explicit configuration.
• Keep implementations simple and understandable.
• Follow the project's architectural principles.

As the project evolves, additional security measures may include:

• Automated dependency scanning
• Static security analysis
• Software Bill of Materials (SBOM)
• Signed release artifacts
• Automated security testing
• Continuous vulnerability monitoring

These improvements will be introduced as the framework matures.

Security-related issues should be reported privately to the project maintainers.

A dedicated security contact address may be introduced as the project grows.

The ATLAS project appreciates everyone who responsibly reports security issues and helps improve the safety and reliability of the framework.

Responsible security research benefits the entire community.

Security is not a feature.

It is a continuous engineering practice that influences architecture, implementation, testing, documentation, and maintenance throughout the lifetime of the project.

Every contribution should strengthen the security, stability, and reliability of ATLAS.