If you discover a security vulnerability in Bausteinsicht, please report it responsibly using GitHub's Security Advisory mechanism.

1. Do NOT open a public issue — this exposes the vulnerability before a patch is available
2. Use GitHub Security Advisory: https://github.com/docToolchain/Bausteinsicht/security/advisories
3. Include:
   • Description of the vulnerability
   • Affected versions (or branch)
   • Steps to reproduce (if possible)
   • Potential impact
   • Suggested fix (optional)

We aim to:

• Acknowledge your report within 24 hours
• Confirm/triage within 48 hours
• Release patch within 5 business days (for critical issues)
• Publicly disclose after patching or 90 days (whichever is sooner)

Only the latest minor version receives security updates.

Once patched, vulnerabilities are disclosed in the repository's Security tab with:

• CVE-ID (if applicable)
• Affected versions
• Impact assessment
• Patch details
• Credits to reporter (unless requested otherwise)

1. A patch has been released, AND
2. A reasonable time (typically 48 hours) has passed for users to patch

Bausteinsicht follows SLSA (Supply-chain Levels for Software Artifacts) Level 2:

• ✅ Source control: Git commits to GitHub
• ✅ Provenance: Release artifacts include commit hash (-X main.version={{.Version}})
• ✅ SBOM: Software Bill of Materials included in all releases
• ✅ Code review: All changes reviewed before merge (see CONTRIBUTING.md)
• ✅ Signed commits (recommended): git config commit.gpgsign true
• ✅ Signed releases: All v1.0.0+ releases are cryptographically signed

While optional, we strongly encourage signed commits:

# Configure Git to sign commits
git config --global commit.gpgsign true

# Or sign per-commit
git commit -S -m "your message"

# Verify signatures
git log --pretty=format:"%h %G? %s"  # %G? shows valid (G), bad (B), or untrusted (U)

GitHub will show a "Verified" badge next to signed commits, indicating:

• The committer has proven their identity
• The commit has not been tampered with

For v1.0.0 and later, all releases are signed using the repository's default signing key:

# Verify release signature
gh release view v1.0.0 --json assets
# Check GitHub UI for "Verified" badge

# Download and verify checksums
curl -O https://github.com/docToolchain/Bausteinsicht/releases/download/v1.0.0/checksums.txt
shasum -a 256 bausteinsicht_1.0.0_linux_amd64 | grep -f checksums.txt

We use GitHub's Dependabot to:

• Monitor dependencies daily
• Alert on security updates
• Open PRs with patches (security priority)
• Detect outdated versions

All PR builds run:

• govulncheck ./... — scan for known Go vulnerabilities (go.dev/vuln)
• gosec — static analysis for security issues

1. Critical (CVSS ≥ 9.0): Patch within 24 hours
2. High (CVSS 7.0-8.9): Patch within 5 days
3. Medium (CVSS 4.0-6.9): Patch in next minor release
4. Low (CVSS < 4.0): Patch with other maintenance

Exceptions may apply for:

• Vulnerabilities only affecting development dependencies (test tools, CI)
• Vulnerabilities requiring Go runtime update (outside project control)

Bausteinsicht is a local CLI tool with these characteristics:

• No network communication (except downloading releases)
• No remote authentication
• No user database or persistent storage
• No server component

1. Report immediately via GitHub Security Advisory
2. Do not open public issues
3. Include: How the exploit works, when it was discovered
4. Do not publish details until patch is available

We will:

• Acknowledge receipt within 24 hours
• Investigate and develop a patch
• Release a patch release (e.g., v1.0.1)
• Publicly disclose after patching (or 90 days max)

For security issues, contact maintainers via:

• GitHub Security Advisory: https://github.com/docToolchain/Bausteinsicht/security/advisories
• Email: [See repository contact info or CONTRIBUTING.md]

Do not use public issues or pull requests for security disclosures.

• SBOM.md — Software Bill of Materials, dependency audit
• CONTRIBUTING.md — Contributing guidelines, code review policy
• SLSA.dev — Supply chain security framework
• OWASP Top 10 — Common security risks