# Security policy

Open Print is still preparing its first stable release. Security fixes are made
on the current `1.0` development branch; there is no supported older release
line yet.

## Reporting a vulnerability

Please use GitHub's private vulnerability reporting for this repository. That
keeps exploit details out of public issues while a fix is being prepared. If
private reporting is unavailable, open an issue titled `Security contact
request` without technical details, private records, credentials, or signing
material. A maintainer can then arrange a private channel.

Useful reports include the smallest record or script that demonstrates the
problem, the Open Print version or commit, the expected result, the actual
result, and a short account of the likely impact. Never include a real issuer
private key. A newly generated test key is enough for a reproduction.

Good-faith research against your own records and local installations is
welcome. Do not test against someone else's service, try to obtain private
collector data, or disrupt a gallery or artist system.

## What counts as a security issue

Examples include:

- a changed certificate, registry event, checkpoint, or archive being accepted
  as intact;
- a signature being accepted for the wrong issuer, key, record, or validity
  period;
- duplicate certificate identities or edition sequences being committed;
- a rollback or checkpoint fork going undetected when the verifier has the
  required earlier checkpoint;
- path traversal, unsafe overwrite, or lock bypass in the Node file store;
- private signing material or private collector labels entering public output;
- a release artifact that cannot be tied back to its reviewed source.

Open Print does not provide DRM, legal ownership adjudication, identity checks,
payment security, hosting security, or protection for applications that expose
their private signing keys. Those boundaries are described in
`docs/THREAT_MODEL.md`.

## Disclosure

Please allow time to reproduce the issue, understand whether existing records
are affected, and prepare compatible fixtures and documentation. The project
will credit reporters who want to be named. There is currently no bug-bounty
program and no guaranteed response window.