Do not open a public issue for security vulnerabilities. Instead, please report security issues to the Lab271 team directly.

1. Email: Send a detailed report to labs@schubergphilis.com

   • Include a clear description of the vulnerability
   • Provide steps to reproduce (if applicable)
   • Mention any tools or techniques you used to discover it

2. Response Timeline:

   • You will receive an acknowledgment within 48 hours
   • We will investigate and provide updates every 7 days
   • We aim to release a patch within 30 days of confirmation

3. Disclosure:

   • We practice responsible disclosure
   • Please do not disclose the vulnerability publicly until we have released a patch
   • We will credit you in the release notes if you wish

• Use HTTPS for all git operations
• Enable GPG signing for commits when possible
• Keep your local dependencies updated
• Run dependabot checks locally before pushing
• Follow the principle of least privilege in code review

• Keep dependencies updated regularly
• Review security advisories from GitHub Dependabot
• Ensure CI checks (build + workflow audit) pass before merging
• Use branch protection rules and require status checks
• Never commit credentials — push protection will block them

This project uses:

• Dependabot: Automated dependency scanning and updates
  • Security updates arrive immediately (no cooldown applied)
  • Version updates are held for a cooldown period before a PR opens — 3 days for patches, 7 for minors, 30 for majors. A compromised release is usually yanked within that window, so we never pull it.
  • Astro majors are excluded from automatic updates; they must be coordinated with @astrojs/starlight.
• Zizmor: Static audit of GitHub Actions workflows on every PR, catching unpinned actions, impostor commits, and excessive token permissions.
• GitHub Secret Scanning with push protection: commits containing credentials are blocked before they reach the remote.
• Branch Protection on main: requires passing status checks and one approving review; enforced for administrators.

All CI actions are pinned to full commit SHAs rather than tags.

We monitor the following vulnerability databases:

• GitHub Advisory Database
• National Vulnerability Database (NVD)
• npm Security Advisories
• Common Weakness Enumeration (CWE)

If you have questions about this security policy, please reach out to labs@schubergphilis.com.