audit-labs/gh-attest

 1# Security Policy
 2
 3## Supported versions
 4
 5gh-attest is a hosted GitHub App. There is one supported version — the
 6currently deployed one. Fixes are rolled out to all installations at once;
 7there is nothing for you to upgrade.
 8
 9## Reporting a vulnerability
10
11Please report privately rather than opening a public issue.
12
13- **Preferred:** [Report a vulnerability](https://github.com/audit-labs/gh-attest/security/advisories/new)
14  via GitHub private vulnerability reporting.
15- **Alternative:** email `security@audit-labs.dev`.
16
17Please include enough detail to reproduce: the endpoint or component, the
18request, and what you observed. If you have a proof of concept, use your own
19organization's installation.
20
21We aim to acknowledge within 3 working days and to keep you updated until the
22issue is resolved. We will credit you when publishing a fix unless you prefer
23otherwise. We do not currently run a paid bug bounty.
24
25## Scope
26
27**In scope**
28
29- The Worker and its endpoints, including webhook signature verification,
30  session handling, and the `/admin/*` bearer-guarded routes.
31- Tenant isolation — anything allowing one installation to read another's
32  evidence or exports.
33- The evidence pipeline, where incorrect data could mislead an audit.
34
35**Out of scope**
36
37- GitHub and Cloudflare themselves. Report those to
38  [GitHub](https://bounty.github.com/) and
39  [Cloudflare](https://hackerone.com/cloudflare) respectively.
40- Findings that gh-attest *reports about your own organization* — a repository
41  without branch protection is the product working, not a vulnerability.
42- Denial of service, volumetric testing, and social engineering.
43
44## Testing guidance
45
46Please test against an installation on an organization you control. Do not
47attempt to access data belonging to another installation; if you believe you
48have found a way to, stop and report it rather than confirming the extent.
49
50## How gh-attest handles data
51
52Read-only GitHub scopes, short-lived installation tokens that are never
53persisted, no source code or personal access tokens stored, and all data held
54in the EU. See [PRIVACY.md](PRIVACY.md) for the full description and
55[README.md](README.md) for the architecture.