We take security issues seriously. Please do not file a public GitHub issue for security vulnerabilities.

Use GitHub's private vulnerability reporting to open a draft security advisory. This keeps the disclosure private until a fix is available.

If you are unable to use the GitHub advisory form, send details to the maintainer via email (address available on the GitHub profile for @sassdawe).

Please provide as much of the following as possible:

• A clear description of the vulnerability and its potential impact.
• Steps to reproduce the issue (proof-of-concept or reproduction script if available).
• The affected version(s) of BrowserAptor.
• Any suggested mitigations or patches you have already identified.

We will confirm receipt of your report and keep you updated as we work through the fix.

We follow responsible disclosure:

1. The reporter submits the issue privately.
2. We acknowledge and investigate.
3. We develop and test a fix.
4. We publish the fix and create a GitHub Security Advisory with CVE attribution where appropriate.
5. We credit the reporter in the advisory (unless they prefer to remain anonymous).

This repository uses the following automated security tooling:

• CodeQL — static analysis on every push to main and every pull request.
• Dependency Review — checks NuGet dependency changes on every pull request for known vulnerabilities.
• NuGet vulnerability audit — dotnet list package --vulnerable runs in CI on every build.
• Dependabot — automatically opens PRs for NuGet and GitHub Actions updates.
• SBOM — a CycloneDX JSON Software Bill of Materials is generated and published with every release.
• Artifact attestation — release artifacts are signed with GitHub's build provenance attestation.