SECURITY.md

Security Policy

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly by contacting the maintainers directly. Do not open a public issue.

Secrets Management

This project follows strict secret management practices:

Development

• Use .NET User Secrets for local development
• Never commit secrets to source control
• appsettings.Development.json is excluded via .gitignore

Production

• Use Azure Key Vault for production secrets
• Use Managed Identity where possible
• Prefer certificate-based authentication over client secrets

What NOT to do

• ❌ Do not hardcode secrets in appsettings.json
• ❌ Do not pass secrets via command-line arguments
• ❌ Do not log access tokens or secrets
• ❌ Do not commit .env files with real values

Supported Versions

Version	Supported
Latest	✅