# Vulnerability Reporting And Response

This page documents the current private disclosure path and response
expectations for SINT.

Use it as the source of truth for security-intake guidance referenced by
`SECURITY.md`, OpenSSF readiness work, and coordinated disclosure planning.

## Current Intake Path

The supported private intake path is:

- `i@pshkv.com`

Required subject line:

- `[SINT-SECURITY]`

Do not open a public GitHub issue for a vulnerability report.

## Why This Is The Supported Path

The repo previously pointed to `security@sint.ai`, but the public
infrastructure did not support that as a verified disclosure path.

Verification performed on 2026-05-21:

- `pshkv.com` publishes live Google Workspace MX records
- `sint.ai` resolves as a web domain, but has no public MX record
- `sint.ai` currently redirects to an Atom landing page rather than an active
  project site

The practical outcome is simple:

- use `i@pshkv.com` for private vulnerability intake until a dedicated SINT
  security mailbox is actually live and verifiable

## Response SLA

| Stage | Current expectation |
| --- | --- |
| Initial acknowledgement | within 48 hours |
| Severity classification and next-step response | within 10 business days |
| Status updates for valid reports | at least weekly until remediation or disclosure plan is agreed |
| Public advisory publication | after fix, mitigation, or coordinated disclosure decision |

## Report Contents

Please include:

1. affected package, path, or deployment slice
2. reproduction steps or proof artifact
3. expected vs actual behavior
4. practical impact
5. suggested remediation, if known

## Disclosure Expectations

- maintainers will coordinate remediation and disclosure timing with the
  reporter
- please avoid public disclosure until a fix is released or a coordinated date
  is agreed
- when a public advisory is needed, maintainers will publish it through GitHub
  Security Advisories

## GitHub Advisory Note

As of 2026-05-21, the repo should not rely on GitHub-hosted private
vulnerability intake as the only reported path in public docs.

Public advisories remain a supported publication surface.

If repo-native private vulnerability reporting is enabled later, this page
should be updated to list it as an additional intake option rather than a vague
future reference.
