If you discover a security vulnerability, please do not open a public issue. Instead, use one of these channels:

1. GitHub Private Vulnerability Reporting (preferred): https://github.com/Islanders-Treasure0969/de-fullstack-demo/security/advisories/new
2. Email the maintainer directly via the address in the GitHub profile.

You can expect:

• Acknowledgement within 72 hours
• An initial assessment within 1 week
• A coordinated fix and disclosure timeline communicated upfront

This project is a learning playground and does not ship as a versioned library. The main branch is the only supported version. Security fixes are applied directly to main.

This repository ships with the following automated security controls:

Auto-merge requires all status checks (CI / CodeQL / Trivy) to pass.

• Secrets are managed via 1Password CLI (op run --env-file=.env); see ADR-0008.
• .env is committed but contains only op:// references — no plaintext secrets.
• .env.local is gitignored and used by users not on 1Password.
• LocalStack uses dummy AWS credentials (AKIAIOSFODNN7EXAMPLE).
• pre-commit hooks block accidental secret commits via gitleaks.
• GitHub Secret Scanning + Push Protection are enabled at the repo level.
• Never commit real cloud credentials, real PATs, or .env.local to this repo.