Add security response policy

Author: ammarheidari

README.md

@@ -40,6 +40,7 @@ The first production milestone is M3UA over a transport abstraction. SCCP, TCAP,
 | External interoperability evidence | Phase 7 registry added for peer-stack lab results and packet trace references; current evidence inventory is empty until real lab artifacts are captured |
 | Release candidates | Phase 7 manifest added for package version, source commit, internal release gates, and commercial promotion gates |
 | Package governance | Phase 7 policy added: current package metadata is tracked; commercial target still requires package signing and SBOM automation |
+| Security governance | Phase 7 security policy added with private disclosure and severity response targets |
 
 ## Requirements
 
@@ -127,6 +128,7 @@ if (!M3uaTypedMessageParser.TryParseSignallingCongestion(
 - [SCTP Transport](docs/SCTP_TRANSPORT.md)
 - [References](docs/REFERENCES.md)
 - [Quality and contribution rules](docs/QUALITY.md)
+- [Security policy](SECURITY.md)
 
 ## Project Direction
 

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+SIGTRAN.NET uses private disclosure for security issues.
+
+## Reporting
+
+Report suspected vulnerabilities to `security@sigtran.net`.
+
+Do not publish exploit details publicly before the issue has been triaged and a coordinated fix path is available.
+
+## Response Targets
+
+| Severity | Target response |
+| --- | --- |
+| Critical | 2 days |
+| High | 7 days |
+| Moderate | 14 days |
+| Low | 14 days |
+
+The SDK exposes this policy through `SigtranSecurityPolicy.CreateCurrentPolicy()` so release tooling and downstream governance checks can reference the same response targets.

docs/PHASE7_COMMERCIALIZATION.md

@@ -62,3 +62,9 @@ Release candidates can be published after internal gates pass. Promotion to comm
 `SigtranPackageGovernance.CreateCommercialTargetPolicy()` adds the commercial governance target: package signing and SBOM publication.
 
 Commercial release governance remains incomplete until signing and SBOM automation are added to the release pipeline.
+
+## Security Policy
+
+`SECURITY.md` defines the public disclosure process and response targets. `SigtranSecurityPolicy.CreateCurrentPolicy()` exposes the same values to SDK governance tooling.
+
+Critical vulnerabilities target a 2-day response. High severity vulnerabilities target a 7-day response. Other severities target a 14-day response.

src/sigtran.net.Tests/Program.cs

@@ -25,6 +25,7 @@
 Run("SIGTRAN interop evidence registry tracks lab results", SigtranInteropEvidenceRegistryTracksLabResults);
 Run("SIGTRAN release candidate manifest reports promotion gates", SigtranReleaseCandidateManifestReportsPromotionGates);
 Run("SIGTRAN package governance reports commercial requirements", SigtranPackageGovernanceReportsCommercialRequirements);
+Run("SIGTRAN security policy reports response targets", SigtranSecurityPolicyReportsResponseTargets);
 Run("TCAP BER element encodes short and long lengths", TcapBerElementEncodesShortAndLongLengths);
 Run("TCAP transaction identifiers use BER context tags", TcapTransactionIdentifiersUseBerContextTags);
 Run("TCAP BER Invoke component round-trips", TcapBerInvokeComponentRoundTrips);
@@ -328,6 +329,16 @@ static void SigtranPackageGovernanceReportsCommercialRequirements()
     Assert(commercial.Describe().Contains("sbom=True", StringComparison.Ordinal), commercial.Describe());
 }
 
+static void SigtranSecurityPolicyReportsResponseTargets()
+{
+    SigtranSecurityResponsePolicy policy = SigtranSecurityPolicy.CreateCurrentPolicy();
+
+    Assert(policy.UsesPrivateDisclosure, "security policy should use private disclosure");
+    AssertEqual(TimeSpan.FromDays(2), policy.GetResponseTime(SigtranSecuritySeverity.Critical), "critical security response time");
+    AssertEqual(TimeSpan.FromDays(7), policy.GetResponseTime(SigtranSecuritySeverity.High), "high security response time");
+    AssertEqual(TimeSpan.FromDays(14), policy.GetResponseTime(SigtranSecuritySeverity.Low), "low security response time");
+}
+
 static void TcapBerElementEncodesShortAndLongLengths()
 {
     Span<byte> shortBuffer = stackalloc byte[8];

src/sigtran.net/Core/Utilities/SigtranSecurityPolicy.cs

@@ -0,0 +1,84 @@
+namespace sigtran.net.Core.Utilities;
+
+/// <summary>
+/// Identifies security vulnerability severity.
+/// </summary>
+public enum SigtranSecuritySeverity
+{
+    /// <summary>Low severity.</summary>
+    Low,
+
+    /// <summary>Moderate severity.</summary>
+    Moderate,
+
+    /// <summary>High severity.</summary>
+    High,
+
+    /// <summary>Critical severity.</summary>
+    Critical
+}
+
+/// <summary>
+/// Describes the SDK security response policy.
+/// </summary>
+public sealed class SigtranSecurityResponsePolicy
+{
+    /// <summary>Creates a security response policy.</summary>
+    /// <param name="contact">The security contact.</param>
+    /// <param name="criticalResponseTime">The critical issue response time.</param>
+    /// <param name="highResponseTime">The high issue response time.</param>
+    /// <param name="usesPrivateDisclosure">Whether private disclosure is required.</param>
+    public SigtranSecurityResponsePolicy(
+        string contact,
+        TimeSpan criticalResponseTime,
+        TimeSpan highResponseTime,
+        bool usesPrivateDisclosure)
+    {
+        Contact = string.IsNullOrWhiteSpace(contact) ? throw new ArgumentException("Security contact is required.", nameof(contact)) : contact;
+        CriticalResponseTime = criticalResponseTime <= TimeSpan.Zero ? throw new ArgumentOutOfRangeException(nameof(criticalResponseTime)) : criticalResponseTime;
+        HighResponseTime = highResponseTime <= TimeSpan.Zero ? throw new ArgumentOutOfRangeException(nameof(highResponseTime)) : highResponseTime;
+        UsesPrivateDisclosure = usesPrivateDisclosure;
+    }
+
+    /// <summary>The security contact.</summary>
+    public string Contact { get; }
+
+    /// <summary>The critical issue response time.</summary>
+    public TimeSpan CriticalResponseTime { get; }
+
+    /// <summary>The high issue response time.</summary>
+    public TimeSpan HighResponseTime { get; }
+
+    /// <summary>Whether private disclosure is required.</summary>
+    public bool UsesPrivateDisclosure { get; }
+
+    /// <summary>Returns the response time for a severity.</summary>
+    /// <param name="severity">The vulnerability severity.</param>
+    /// <returns>The response time.</returns>
+    public TimeSpan GetResponseTime(SigtranSecuritySeverity severity)
+    {
+        return severity switch
+        {
+            SigtranSecuritySeverity.Critical => CriticalResponseTime,
+            SigtranSecuritySeverity.High => HighResponseTime,
+            _ => TimeSpan.FromDays(14)
+        };
+    }
+}
+
+/// <summary>
+/// Provides the SDK security policy.
+/// </summary>
+public static class SigtranSecurityPolicy
+{
+    /// <summary>Creates the current security response policy.</summary>
+    /// <returns>The current security response policy.</returns>
+    public static SigtranSecurityResponsePolicy CreateCurrentPolicy()
+    {
+        return new(
+            "security@sigtran.net",
+            TimeSpan.FromDays(2),
+            TimeSpan.FromDays(7),
+            usesPrivateDisclosure: true);
+    }
+}