Security reporting and disclosure

Scope

This policy covers the root static reference implementation and its distributed assets. Blog, Journal, accounts, catalogs, learning, and public discovery are scoped platform services covered by the same reporting process. A vulnerability in GitHub, a cited source, a related project, or a hosting provider should follow that service’s own policy.

Information to include

• Affected canonical URL, asset, or release version.
• A clear description of the issue and its practical impact.
• Minimal reproducible steps and relevant browser or environment information.
• Evidence sufficient to explain the issue, excluding secret values and unrelated personal information.
• A contact method if follow-up is needed.

Responsible disclosure

Use contact@syntheticforensics.org for an initial report. Do not publish credentials or private evidence. Avoid disruptive activity, unauthorized access, or collection beyond what is necessary to describe the issue. Coordinate publication when follow-up is possible; no guaranteed response interval is stated.

The project publishes security.txt as a contact discovery aid. The address’s existence does not imply encryption or a dedicated response team. For sensitive material, request an appropriate transfer method before sending it.

Platform implementation

The root reference uses static pages alongside PHP platform services and a private SQLite database. Public search escapes supplied text and indexes explicit public projections; account and editorial routes enforce their own authorization. Release hashes support file-integrity comparison. Hosting security, TLS, server logs, application installation, and backup controls remain owner responsibilities.