intelligence-terminal/SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security issue in Intelligence Terminal, please report it privately instead of opening a public issue.

Use the private security contact configured for this Gitea repository or contact the repository owner directly.

Use a subject line like:

[Intelligence Terminal Security] short description

Please include:

• affected component or file
• steps to reproduce
• impact
• proof of concept if available
• any suggested remediation

Response Expectations

Best-effort targets:

• acknowledgement within 72 hours
• initial triage within 7 days
• coordinated disclosure after a fix is available

Scope

The highest-priority reports are:

• XSS or HTML/script injection in the dashboard
• unsafe rendering of mixed-source external content
• authentication or secret-handling issues
• server-side injection or path traversal
• dependency or supply-chain issues with real exploit impact

Out of Scope

The following are generally lower priority unless they create a concrete exploit path:

• minor UI bugs
• missing best-practice headers without impact
• rate limiting or reliability issues without a security consequence

Public Disclosure

Please do not disclose the issue publicly until a fix is shipped or we agree on a disclosure timeline.