SecureLoop is a security automation tool. We take the security of this project seriously. This document describes how to responsibly disclose vulnerabilities found in SecureLoop itself.

Note: The demo/vulnerable_app/ directory contains intentional vulnerabilities for demonstration purposes. Please do not report these as security issues — they are expected.

If you discover a real security issue in SecureLoop's source code (e.g., in tools/, agents/, dashboard.py, or demo_runner.py):

Please do NOT open a public GitHub issue for security vulnerabilities.

Instead:

1. Email: Send a description to the repository owner via GitHub private contact or profile email.
2. Include:
   • A description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Suggested fix (optional but appreciated)

We will acknowledge your report within 48 hours and aim to release a fix within 7 days for critical issues.

In scope:

• Vulnerabilities in tools/ Python backend modules
• Security issues in the dashboard.py Flask web server
• Unsafe handling of user-supplied input in any module

Out of scope:

• Intentional vulnerabilities in demo/vulnerable_app/ (these are educational)
• Issues in third-party dependencies (report upstream)
• Security issues requiring physical access to the machine

We will credit responsible disclosures in the project CHANGELOG unless you prefer to remain anonymous.

Thank you for helping keep SecureLoop secure.