This policy covers the VulnScan project itself:

• The CLI application (vulnscan.py) and its supporting modules (src/config.py, src/github_client.py, src/parser.py, src/scanner.py, src/analyzer.py, src/reporter.py)
• Dependency manifest parsing for all supported ecosystems (pip, npm, Go, Maven, gem, NuGet, Cargo)
• Handling of credentials (GITHUB_TOKEN, LLM API keys, NVD_API_KEY) supplied via CLI flags, environment variables, or .env
• Interaction with upstream services (GitHub REST API, OSV.dev, configured LLM providers) initiated by VulnScan
• Output generation (text, JSON, SARIF) and any injection or data-integrity issues arising from untrusted manifest content flowing into those outputs

Out of scope: vulnerabilities in third-party packages that VulnScan reports on (report those to the affected package's maintainers or via OSV.dev), and vulnerabilities in third-party LLM provider APIs themselves.

Report security issues privately using GitHub Security Advisories:

1. Go to the repository's Security tab
2. Select Report a vulnerability
3. Provide a description, reproduction steps, affected version/commit, and impact assessment

This is the only supported reporting channel for this project. Do not open a public GitHub issue for a security report, and do not report vulnerabilities through unsolicited email — no separate security contact address is maintained outside GitHub Security Advisories.

Include, where applicable:

• The command or code path that triggers the issue
• Sample input (e.g., a crafted manifest file) that reproduces it
• Whether exploitation requires a malicious target repository, a malicious LLM response, or attacker control over scanned dependency files
• Potential impact (e.g., arbitrary file read/write, credential exposure, command injection, SSRF against OSV.dev/LLM endpoints)

• Acknowledgment: within 72 hours of submission via GitHub Security Advisories
• Triage: the report is assessed for validity and severity; you will be kept informed of status
• Resolution target: confirmed vulnerabilities are targeted for a fix and coordinated public disclosure within 90 days of the initial report
• Coordinated disclosure: a fix (patched release or documented mitigation) is prepared before any public advisory is published; the reporter is credited unless anonymity is requested

If a fix requires longer than 90 days (e.g., due to upstream dependency constraints), the reporter will be notified with a revised timeline rather than disclosure being delayed silently.

• Do not publicly disclose a vulnerability (blog post, social media, public issue, mailing list, etc.) before a fix has been released and coordinated disclosure has occurred
• Do not test against repositories or accounts you do not own or have explicit permission to scan
• Do not exfiltrate, publish, or retain any credentials, tokens, or LLM API keys encountered while testing

VulnScan does not yet maintain multiple release branches. Security fixes are applied to the latest version on the default branch. Once tagged releases exist, this section will be updated to reflect which versions receive patches.