# Security Policy

## Reporting a vulnerability

If you believe you have found a security vulnerability, **do not open a public issue or PR**. Instead, contact the platform team privately:

- Email: `security@loma-portal.example` (placeholder — replace before publishing)
- Encrypted email preferred. PGP key fingerprint: `TBD`

Please include:

1. A description of the issue and the impact.
2. Steps to reproduce, or a proof-of-concept.
3. The affected component (app, package, module) and version/commit.
4. Any suggested remediation.

We aim to acknowledge within **2 business days** and provide an initial assessment within **5 business days**.

## Scope

In scope:

- Code in this repository (apps, packages, modules, infrastructure as code).
- Production hosting if you have explicit authorization.

Out of scope (responsibly disclose to the upstream maintainer):

- Third-party libraries and their CVEs (we monitor via `pnpm audit` and `dotnet list package --vulnerable`).
- Cloud provider issues.

## Coordinated disclosure

We follow coordinated disclosure. Once a fix is shipped and customers are upgraded, we will:

1. Publish an advisory on the repo with credit (unless the reporter prefers anonymity).
2. Update [`docs/compliance/breach-response-playbook.md`](docs/compliance/breach-response-playbook.md) (added Phase 8) if user data was affected.

## Baseline mitigations in the codebase

- Argon2id password hashing.
- JWT + refresh token rotation; secure-cookie defaults.
- RBAC + policy-based authorization. Multi-tenant isolation tests (if `multiTenant=true`).
- CSP, HSTS, X-Frame-Options, Referrer-Policy via middleware.
- Strict CORS by default.
- Rate limiting (throttler + Nginx).
- Secret scanning pre-commit (`.claude/hooks/secret-scan.sh`; upgraded to gitleaks in Phase 8).
- Dependency vulnerability scanning in CI (Phase 8).
- Audit log on authentication events, role changes, and sensitive-data access.

See `docs/compliance/` (added Phase 8) for PDPA + GDPR mappings and runbooks.
