Report security issues against the current main branch unless you are running a specific release tag.

If you discover a security issue, do not open a public GitHub issue.

Contact the maintainers privately through GitHub Security Advisories on this repository, or reach out to SafetyMP directly.

Please include:

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Suggested fix (if any)

We aim to acknowledge reports within a reasonable timeframe and will coordinate disclosure after a fix is available.

Support expectations for non-security issues: SUPPORT.md.

This repository targets local development and CI, not production deployment as-is:

• No production authentication — Phase 3 uses mock principals only (ADR-009 D20); Cedar Service verifies Authorization: Bearer HS256 JWT (sub + roles + required exp; optional iss/aud via env). Not legacy X-Principal headers. Optional INTERNAL_API_TOKEN gates alert/decision/graph APIs when set.
• Default credentials in Docker Compose (PostgreSQL, Kafka, Redis, immudb, Neo4j in dev)
• No TLS on local service ports
• Kafka trust boundary — brokers listen on PLAINTEXT; any host that can reach :9092 can produce/consume. Treat Kafka and schema-registry as a sensitive trust zone; do not expose to untrusted networks
• GHCR deploy publishes application images; policy bundles are bind-mounted from the repo clone — not production-hardened (deployment.md)

Do not expose Compose ports to untrusted networks. Do not deploy the dev stack unchanged to production.

On docker-compose.deploy.yml, Kafka, PostgreSQL, Redis, immudb, Neo4j, schema-registry, Debezium, and Grafana admin ports bind to 127.0.0.1 only.

• Never commit .env or real credentials
• Use .env.example for documented placeholders only
• Review PRs for secrets before merge
• Avro schema changes must remain BACKWARD compatible (see schema-compat.yml)