OSVauco/opax-web/SECURITY.md

Security Policy

Responsible Disclosure

To report a security vulnerability, please send a private email to chris.christiansen@vauco.no.

Do not include sensitive information, customer data, or secrets in public GitHub issues or chat discussions.

Credential Security

• NEVER commit credentials, secrets, or tokens to the Git repository.
• NEVER include credentials in logs, frontend code, or any other uncontrolled files.
• If a credential is accidentally exposed, it MUST be rotated immediately.
• For production environments, all secrets must be stored in a dedicated secret management service (e.g., Google Secret Manager) and accessed using least-privilege IAM principles.