This policy applies to all repositories under the skilluv GitHub organization:

• skilluv-backend — Rust/Axum API
• skilluv-frontend — SvelteKit public app
• skilluv-admin — SvelteKit admin panel
• skilluv-ia — Python AI service

Individual repositories may include their own SECURITY.md for scope-specific notes; this document is authoritative for reporting and disclosure.

Please do not open public GitHub issues for security reports.

Use one of the following private channels:

1. GitHub Private Vulnerability Reporting (preferred) — open a report from the Security tab of the affected repository.
2. Email — send details to security@skilluv.io (or the address published on https://skilluv.io).

Include, when possible:

• Affected repository, branch, commit, or deployed environment.
• Steps to reproduce, proof-of-concept, and expected vs. observed behavior.
• Impact assessment (confidentiality / integrity / availability, affected user roles).
• Whether the issue is already public elsewhere.

We will acknowledge your report within 72 hours, and aim to provide a triage decision and remediation plan within 7 days.

Only the master branch of each repository is actively supported. Historical tags and pre-release branches receive fixes only when a vulnerability is severe and no upgrade path exists.

We follow a coordinated disclosure model:

• We work with the reporter to reproduce and validate the issue.
• We prepare a fix, security advisory, and (when relevant) migration notes.
• We publish the advisory and credit the reporter (unless they request anonymity) after the fix is deployed to production and users have had a reasonable window to update.

In scope:

• Authentication, session, and authorization flaws (including admin / capability escalation).
• Injection (SQL, command, template, header, log).
• Server-side request forgery, path traversal, insecure deserialization.
• Sensitive data exposure (secrets, PII, KYC, wallet, payout, moderation queues).
• Broken access control across tenants, teams, moderation, or admin routes.
• Cryptographic misuse, weak randomness, missing signature verification.
• Supply-chain issues in our first-party code or lockfiles.

Out of scope:

• Denial-of-service via traffic volume (rate-limit tuning).
• Reports based solely on scanner output without demonstrated impact.
• Vulnerabilities in third-party services we consume (please report upstream).
• Social engineering of Skilluv staff, mentors, or users.
• Physical attacks against contributor devices.

Good-faith security research conducted under this policy will not be pursued legally, provided you:

• Do not access, modify, or exfiltrate user data beyond what is strictly necessary to demonstrate the issue.
• Do not degrade service availability for other users.
• Give us a reasonable window to remediate before public disclosure.
• Comply with applicable law.

Thank you for helping keep Skilluv and its community safe.