If you discover a security vulnerability, please report it privately:
- Do NOT open a public GitHub issue
- Use private vulnerability reporting or contact the maintainer via GitHub profile
- Include: description, reproduction steps, impact assessment, and suggested fix if possible
This is a maintainer-supported project. Responses are best-effort — there are no guaranteed SLAs. Critical issues (credential leaks, RCE) will be prioritized.
| Version | Supported |
|---|---|
| main branch | Yes |
| Feature branches | Best effort |
See RISK_PROFILE.md and ADR-0001 for security design decisions.
Key protections:
- Webhook HMAC-SHA256 signature verification
- KMS dual-layer token encryption
- OAuth with CSRF protection
- WAF rate limiting
- Per-handler idempotency
- Least-privilege IAM roles