Please report vulnerabilities privately via GitHub Security Advisories on this repository. Do not open a public issue for security reports.

You can expect an acknowledgement within 7 days. There is no bug bounty.

This repository holds a static site (GitHub Pages) and its scan-directory pipeline. Reports about the site content, the build/publish workflows, or the supply-chain controls configured under .sscsb/ are all in scope.

Machine-readable posture lives in security-insights.yml (OpenSSF Security Insights v2). Controls are managed by sscs-bootstrapper; run sscsb status in a clone to see them.