Developed for safety-critical applications (disaster warning systems). Responsible disclosure protects all users of this library.

If you discover a security vulnerability:

1. Do NOT open a public issue.
2. Email azaraC+security@vrice.f5.si with:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
3. You will receive an initial response within 72 hours.
4. We will work with you to understand and address the issue before any public disclosure.

Critical vulnerabilities will be published as GitHub Security Advisories.

We use Renovate to keep dependencies up to date. All dependency updates are reviewed and merged only after passing CI tests.

• All GitHub Releases include SLSA Level 3 provenance attestations (multiple.intoto.jsonl) generated by slsa-github-generator and hosted on the Sigstore Rekor transparency log. SLSA Level 3 guarantees the artifact was built on a hosted builder with a non-falsifiable provenance — the source repository, tag, and build steps are cryptographically attested.
• Build artifacts are signed via GitHub Artifact Attestations (Sigstore) and can be verified with gh attestation verify.
• Source archives are verified before release creation.

# 1. Download the release assets (e.g. v1.0.2)
gh release download v1.0.2 --repo A-vrice/azaraC
# contains: azaraC-1.0.2.tar.gz, azaraC-1.0.2.zip, multiple.intoto.jsonl

# 2. Verify SLSA provenance (requires slsa-verifier)
slsa-verifier verify-artifact azaraC-1.0.2.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/A-vrice/azaraC \
  --source-tag v1.0.2

# 3. (alternative) Verify Sigstore attestation
gh attestation verify azaraC-1.0.2.tar.gz --repo A-vrice/azaraC

This security policy covers the azaraC library code distributed via GitHub Releases. It does not cover:

• Third-party libraries or dependencies
• Hardware implementations using this library
• Applications built with this library