For security vulnerabilities, please use GitHub's private vulnerability reporting:

1. Go to the Security tab
2. Click "Report a vulnerability"
3. Provide detailed information about the issue

Response times:

• Initial acknowledgment: Within 48 hours
• Severity assessment: Within 7 days
• Fix timeline varies by severity

Alternative: For sensitive issues that cannot be reported via GitHub, contact: [email protected] (TODO: establish)

This is a multi-module Go workspace. All modules are currently in active development:

Security patches are applied to the main branch and will be included in the next release.

This repository implements comprehensive security measures:

• Automated scanning: CodeQL, Trivy, Semgrep, OWASP ZAP
• Security commands: eac scan with multiple scanner types
• Continuous monitoring: Security workflows run on every push and PR

For detailed information, see our comprehensive documentation:

• Security Practices - Shift-left security, SAST, DAST, supply chain security
• Security Workflows - Automated security scanning
• Scan Command - Running security scans locally

• Code: MIT License
• Documentation: CC-BY-SA-4.0