Syllabus Sync -- Coordinated Vulnerability Disclosure

This policy covers the Syllabus Sync web application, its API surface (/api/*), database layer (Supabase PostgreSQL), edge middleware, and all first-party client code deployed to production.

Do not open a public GitHub issue for security vulnerabilities. Public disclosure of an unpatched vulnerability puts users at risk.

Email security@syllabus-sync.dev with:

1. Description -- What the vulnerability is and which component it affects.
2. Reproduction steps -- A minimal, reliable proof-of-concept. Include HTTP requests, screenshots, or code as appropriate.
3. Impact assessment -- Your best estimate of severity (consider confidentiality, integrity, availability). A CVSS 3.1 vector is helpful but not required.
4. Suggested remediation -- If you have one.

Use GitHub's Private Security Advisory feature on this repository to submit findings directly through the GitHub interface.

Target remediation windows:

• Critical / High: 7-14 days
• Medium: 30 days
• Low / Informational: Next scheduled release

We will not pursue legal action against researchers who:

• Act in good faith and comply with this policy.
• Avoid privacy violations, data destruction, and service disruption.
• Report findings exclusively through the channels above.
• Allow reasonable time for remediation before any disclosure.

This commitment aligns with the disclose.io Safe Harbor framework.

Syllabus Sync implements a defense-in-depth strategy grounded in Zero Trust principles. No single control is treated as sufficient; security is enforced at every layer of the stack.

                     Internet
                        |
            +-----------+-----------+
            |   Vercel Edge Network  |
            |   (TLS 1.3 termination)|
            +-----------+-----------+
                        |
            +-----------+-----------+
            | Edge Middleware (proxy) |  <-- JWT validation, CSP injection,
            | lib/proxy.ts           |      CSRF enforcement, rate limiting
            +-----------+-----------+
                        |
            +-----------+-----------+
            |  Next.js API Routes    |  <-- Zod schema validation, HMAC
            |  app/api/*             |      request signing, audit logging
            +-----------+-----------+
                        |
            +-----------+-----------+
            |  Supabase PostgreSQL   |  <-- Row-Level Security (RLS),
            |  + Auth (GoTrue)       |      SECURITY DEFINER RPCs,
            |                        |      encrypted storage (AES-256)
            +------------------------+

• Security Posture Report -- Threat model (STRIDE), full control catalogue, and compliance mapping.
• Security Evidence Index -- File-level evidence matrix for auditors.
• Privacy Policy -- Data inventory, retention, and third-party processors.
• Security Disclosure Policy -- Extended responsible-disclosure program details.