If you discover a security vulnerability in Uteke, please report it responsibly.

Do NOT open a public issue for security vulnerabilities.

Use GitHub Private Vulnerability Reporting — this ensures the report is confidential and only visible to maintainers.

Include as much detail as possible:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment within 48 hours
• Initial assessment within 5 business days
• Fix timeline depends on severity:
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: next minor release

Uteke uses multiple automated security checks on every PR:

• Cargo Audit — dependency vulnerability scanning
• Trivy FS Scan — filesystem security scanning
• GitGuardian — secret leak detection

These are enforced via CI and block merge on findings.