Security Policy / Política de seguridad

Supported versions

Only the main branch and the latest tagged release receive security fixes.

Reporting a vulnerability (responsible disclosure)

Please do not open public issues for security problems.

• Email: security@centinela.dev (PGP key published at https://centinela.dev/.well-known/security.txt).
• Or use GitHub's private vulnerability reporting on this repository.

We acknowledge reports within 2 business days, provide a triage decision within 7 days, and aim to ship fixes for high/critical issues within 30 days. We credit reporters unless they prefer otherwise. We do not pursue legal action against good-faith research that respects this policy and avoids data exfiltration, service disruption or access to other users' data.

Scope

• Everything in this repository: API, web console, executor, workers, Helm charts, Terraform modules, onboarding templates.
• Especially interesting: any path that lets a plan execute without a valid MFA-bound approval, any way for the analysis plane to obtain write credentials, prompt injection that yields out-of-catalog actions, cross-tenant leakage, audit-chain tampering.

Out of scope

• Denial of service through volumetric traffic.
• Findings in third-party services we integrate with (report to them).

Our own supply chain

Images are signed with cosign (keyless) and carry SLSA provenance; all GitHub Actions are pinned by SHA; dependencies are locked. See docs/security/THREAT_MODEL.md.

---

Reporte de vulnerabilidades (ES)

No abras issues públicos para problemas de seguridad. Escribe a security@centinela.dev o usa el reporte privado de GitHub. Acusamos recibo en 2 días hábiles, decisión de triaje en 7 días y corrección de altos/críticos en 30 días.