Please report security vulnerabilities through GitHub's private vulnerability reporting: https://github.com/supervaize/supervaizer/security/advisories/new

Do not report security issues in public issues, discussions, or pull requests.

We will acknowledge receipt within 72 hours and provide an initial assessment within 7 days.

This repository implements the following controls:

• Branch protection via GitHub rulesets on main (enforced on admins)
• Required CI status checks before merge
• Secret scanning with push protection
• Dependabot security updates with a cooldown window on new releases
• uv sync --frozen enforced in CI (lockfile cannot silently change)
• Trusted Publishing (OIDC) for PyPI releases — no long-lived publish tokens
• Required reviewer approval on the pypi environment before publish secrets are exposed
• Third-party GitHub Actions pinned to commit SHAs
• OSV-Scanner in CI (daily + on every PR targeting main or develop) against the OSV.dev malicious package index

If you observe a deviation from this posture, please report it via the private channel above.