This policy applies only to the public repositories listed in profile/README.md. Private or internal systems are out of scope for public disclosure.

1. Do NOT open a public issue for undisclosed vulnerabilities.
2. Email: security@alteriom.example (placeholder; replace with operational address when available).
3. Provide: repository name, affected files, impact overview, reproduction steps.
4. Allow at least 14 days for triage and initial response.

• Schema validation bypass (e.g., incorrect TypeScript definitions allowing unsafe payloads)
• Documentation conversion script injection (malicious input producing unsafe output)
• Metadata normalization producing unintended privilege escalation (if automation expands in scope)

• Cosmetic issues (typos, formatting)
• Vulnerabilities requiring access to private repositories
• Social engineering attacks

1. Triage & confirm.
2. Assign severity (Low / Moderate / High).
3. Develop fix and tests.
4. Publish advisory and patch simultaneously.
5. Credit reporter unless anonymity requested.

(Encryption key to be published here once available.)

Security fixes should increment patch version and reference CVE or internal advisory ID.

Last updated: 2025-10-23