Security

SECURITY.md

Security Policy

Scope

This repository is the public-facing documentation and integration surface for Vartovii.

Do not publish vulnerabilities in public issues or discussions.

Reporting A Vulnerability

If you believe you have found a security issue affecting Vartovii, report it privately to:

sentry@sentryanalytic.com

Please include, when possible:

affected surface or URL
clear reproduction steps
expected impact
logs, screenshots, or proof-of-concept details that help reproduction

Response Expectations

We aim to:

acknowledge valid reports within 2 business days
investigate and triage based on severity
coordinate remediation before any public disclosure

Out Of Scope For Public Disclosure

Please do not use public GitHub issues for:

vulnerabilities in private services
leaked credentials or access tokens
admin or internal route discoveries
cost-abuse paths or rate-limit bypass attempts

Use private reporting instead.

There aren't any published security advisories