The SENTINEL team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings.

Please do NOT report security vulnerabilities through public GitHub issues.

Send an email to security@sentinel-project.dev with the following information:

• A description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any suggested fixes (optional)

The following are in scope for security reports:

• Authentication and authorization flaws in the API server
• Injection vulnerabilities in the scanner or remediation executor
• Unsafe handling of AWS credentials or secrets
• Vulnerabilities in the LocalStack digital twin integration
• Supply chain risks in dependencies
• Insecure default configurations

• Vulnerabilities in LocalStack itself (report to their project)
• Issues in third-party dependencies (report upstream, but let us know)
• Social engineering attacks
• Denial of service attacks against development environments

• Never store AWS credentials in plaintext within the project directory.
• Use IAM roles with least-privilege permissions for production deployments.
• Run the LocalStack digital twin for all remediation testing before applying to production.
• Keep dependencies updated -- run pip audit and npm audit regularly.
• Review remediation actions in the dashboard before approving production execution.

• We follow coordinated vulnerability disclosure.
• We will credit reporters in the security advisory unless they prefer to remain anonymous.
• We will publish a GitHub Security Advisory for confirmed vulnerabilities.

• Email: security@sentinel-project.dev
• GitHub: github.com/milyas2001/sentinel