File size: 1,260 Bytes
61d494c 2f7f52e 61d494c 2f7f52e 61d494c | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 | # Security Policy
## Reporting a Vulnerability
**Do NOT open a public issue for security vulnerabilities.**
Please report security vulnerabilities via email to **security@szlholdings.com** with:
1. Description of the vulnerability
2. Steps to reproduce
3. Potential impact assessment
4. Any suggested mitigations
### Response SLA
| Severity | Initial Response | Resolution Target |
|---|---|---|
| Critical | 24 hours | 7 days |
| High | 48 hours | 30 days |
| Medium | 5 business days | 90 days |
| Low | 10 business days | 180 days |
We follow a **90-day responsible disclosure** policy.
## Supply-Chain Security
- **SLSA Build Level 1** — build provenance generated per release (honest; not L2/L3)
- **DCO required** — all commits carry `Signed-off-by:` trailers per [Linux Foundation DCO](https://developercertificate.org/)
- **Cosign keyless signing** — verify with `cosign verify ghcr.io/szl-holdings/szl-lambda-gate:<tag>`
- **SBOM** — CycloneDX SBOM attached to each release
## Contact
- **Security disclosures:** security@szlholdings.com
- **General:** hello@szlholdings.com
- **Website:** https://szlholdings.com
*This policy follows the [OpenSSF Vulnerability Disclosure Guide](https://github.com/ossf/oss-vulnerability-guide).*
|