# Vulnerability Disclosure Process

## Scope

This process covers security defects in source code, build/release pipeline, dependencies, and deployment artifacts.

## Intake

- Channel: private disclosure only (`hey@sanka.com` or GitHub Security Advisory)
- Public issues for vulnerabilities are not accepted.

## Workflow

1. Intake and acknowledgement.
2. Triage and severity scoring.
3. Private fix development and validation.
4. Coordinated release with advisory.
5. Post-incident review and preventive actions.

## Severity and Targets

- Critical/High: patch target within 30 days
- Medium/Low: patch target within 90 days

## Communication Rules

- Keep reporter updated at each state transition.
- Publish advisory only after fixes are available.
- Include affected versions, fixed versions, and mitigation guidance.

## Auditability

- Every report gets a tracking ID.
- Keep timeline and decisions in private incident records.
- Link advisories to release tags and provenance attestations.
