If you discover a security issue in Habeas Protocol — anything from a data leak in the API, an injection vector in the dashboard, a Catala evaluation that bypasses a certified rule's intended semantics, an issue in the migration scripts, a credential accidentally committed to history, or a supply-chain concern in the clients — please report it privately.

Email: thehamzaq@gmail.com

Subject line suggestion: [Habeas Security] <short description>.

Please do not open a public GitHub issue for security matters until a fix is available.

A useful report typically contains:

• A description of the issue and its impact.
• The component affected (api/, dashboard/, clients/, rules/, scripts/, db/, etc.) and the file(s) or endpoint(s) involved.
• Steps to reproduce, or a minimal proof-of-concept.
• The version, commit SHA, or release tag you tested against.
• Your assessment of severity (low / medium / high / critical), if you have one.
• Whether you would like to be credited in the fix advisory, and under what name.

This project is currently maintained by a small team (initially solo). Response targets are best-effort:

• Acknowledgement: within 3 working days of receipt.
• Initial triage and severity assessment: within 7 working days.
• Fix or mitigation timeline: communicated after triage. Critical issues are prioritized; lower-severity issues may be batched into the next release.
• Disclosure: coordinated. Reporters are credited in the release notes unless they request otherwise.

In scope:

• The Habeas Protocol code in this repository.
• The reference API server (api/server.py) and its endpoints.
• The first-party Python and TypeScript clients (clients/).
• The dashboard (dashboard/).
• The migration and ingestion scripts (scripts/) — particularly any path that reads or writes user-supplied content.
• The Catala rule modules (rules/) — semantic bypasses or rules whose encoding contradicts the cited source are in scope as well.

Out of scope:

• The 121-judgment dataset under data/judgments.json. This is sourced from public court records; factual errors should be reported as regular GitHub issues, not as security reports.
• Third-party services referenced but not operated by this project (court websites, Firecrawl, Postgres itself, OCaml/Catala upstream).
• Issues in unsupported, modified, or fork distributions.

If you run your own instance:

• The reference API server is read-only by design. Do not expose write endpoints (rule authoring, ingestion) to untrusted clients.
• Keep the Postgres instance behind a firewall; the API server expects to be the only client.
• Do not commit data/raw/ or any database dumps to public forks — the structured data/judgments.json is the publishable artefact.
• Rotate any local API tokens you add on top of the reference implementation.

A list of reporters credited for past disclosures will be maintained here once the project has its first acknowledged report.