Security policy

This is the default security policy for every public repository in the sthenos-security organization. A repository with its own SECURITY.md uses that file instead.

Reporting a vulnerability

Please report security vulnerabilities in REACHABLE privately. Do not open a public issue.

• Preferred: use GitHub's private vulnerability reporting on the affected repository (Security tab → "Report a vulnerability").
• Email: support@sthenosec.com with "SECURITY" in the subject.

Include the affected component and version, steps to reproduce, and the impact you observed. We acknowledge reports within 3 business days and keep you informed until the issue is resolved. Please give us a reasonable time to fix the issue before any public disclosure.

Scope

The REACHABLE scanner, its installers and agent plugins, the CI integrations, and REACHABLE Cloud (sthenosec.com). Findings that REACHABLE reports about your code are product output, not vulnerabilities in REACHABLE — please send those to support@sthenosec.com as normal support.

See also https://sthenosec.com/security and https://sthenosec.com/.well-known/security.txt.