Please do not report security issues publicly ❗ Use GitHub's private reporting Security tab. Or use methods below.

1. Email: kh3rld@duck.com (PGP Key [0xABCD1234])
2. Response Time: We acknowledge reports within 48 hours
3. Disclosure: Patched vulnerabilities will be disclosed via GitHub advisories

• All code must pass:

  make lint # Includes gosec and static analysis

• Banned patterns:
  • Unsafe pointer arithmetic (unsafe package)
  • Shell command injection (e.g., unfiltered exec.Command input)

1. Dependencies:

   • Audit third-party packages with:

     go mod audit

   • Report suspicious dependencies immediately

2. Code Reviews:

   • All PRs require security review from maintainers
   • Security-critical changes get 72-hour review period