Only the latest version on the main branch receives security updates.

Note: This is an academic project (ATU BSc Final Year Project, May 2026). Active maintenance is limited to the project submission period.

If you discover a security vulnerability in this project, please report it responsibly:

1. Preferred: Use GitHub's private vulnerability reporting:

   • Go to the Security tab of this repository
   • Click "Report a vulnerability"
   • Provide a clear description of the issue, steps to reproduce, and potential impact

2. Alternative: Open a GitHub issue with the security label (avoid including exploit details in public issues)

3. Do NOT post full exploit details in public issues or discussions

• Acknowledgement: Within 72 hours
• Initial assessment: Within 7 days
• Fix or mitigation: Best effort, depending on severity

This policy covers:

• The application source code in src/
• Docker configuration and deployment scripts
• CI/CD pipeline configurations

Out of scope:

• Third-party dependencies (report to upstream maintainers)
• The YOLO model file itself (report to Ultralytics)

Implemented:

• Static analysis (ruff, mypy)
• Automated tests in CI (pytest)

Planned:

• SAST scanning (Semgrep — #97)
• Dependency scanning (pip-audit — #98, Dependabot)
• Container image scanning (Trivy — #100)
• Pre-commit security checks (Bandit — #128)