We actively support and provide security updates for the following versions:

DO NOT open public GitHub issues for security vulnerabilities.

To report a security vulnerability, please use one of the following methods:

1. GitHub Security Advisories (Recommended): Report a vulnerability
2. Email: Send details to security@pompelmi.dev
3. Private Disclosure: Create a private advisory at the repository

When reporting a vulnerability, please provide:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Suggested fix (if available)
• Your contact information for follow-up

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-3 days
  • High: 3-7 days
  • Medium: 7-14 days
  • Low: 14-30 days

If Accepted:

• We'll work with you to understand and verify the vulnerability
• A fix will be developed and tested
• A security advisory will be published
• Credit will be given unless you prefer to remain anonymous

If Declined:

• We'll provide a clear explanation
• Alternative solutions or mitigations may be suggested

pompelmi implements the following security practices:

• 🔒 Automated dependency scanning via Dependabot
• 🛡️ CodeQL static analysis on all commits
• 📊 OpenSSF Scorecard monitoring
• 🔐 Provenance attestation for npm releases
• ⚡ Regular security audits and updates

When using pompelmi in production:

1. Keep Updated: Always use the latest version
2. Validate Input: Sanitize all user-provided files before scanning
3. Resource Limits: Implement timeouts and size limits
4. Sandbox Execution: Run in isolated environments when possible
5. Review Policies: Customize security policies for your threat model

All published security advisories can be found at: https://github.com/pompelmi/pompelmi/security/advisories

For general security questions or concerns:

• Email: security@pompelmi.dev
• GitHub Discussions: https://github.com/pompelmi/pompelmi/discussions

PGP Key Fingerprint: Contact us for our public key if needed for encrypted communications.