CyberCode Labs takes the security of our software, infrastructure and community projects seriously.

Security updates are typically applied to the latest release of each public repository unless a repository states otherwise.

Please do not open a public GitHub issue for security vulnerabilities.

Report security concerns privately using one of these channels:

1. Email: contacto@cybercodelabs.com.pe
   Prefer a subject line like: [SECURITY] Short description
2. GitHub Security Advisories (when enabled on the repository): use Security → Report a vulnerability

• Affected repository, component or service
• Description of the issue and potential impact
• Steps to reproduce (PoC if available)
• Affected versions, commit SHA or deployment context
• Your preferred contact method for follow-up

• We aim to acknowledge reports within 72 hours
• We will assess severity and share a remediation plan when possible
• Please give us reasonable time to investigate and patch before any public disclosure
• Credit can be given to reporters who wish to be acknowledged (unless they prefer to remain anonymous)

In scope (examples):

• Authentication or authorization flaws
• Injection, XSS, SSRF, RCE and similar application vulnerabilities
• Sensitive data exposure in public repositories or releases
• Misconfigurations with clear security impact in our public projects

Out of scope (examples):

• Social engineering against CyberCode Labs staff or clients
• Denial-of-service testing without prior written approval
• Findings that require physical access or compromised credentials already obtained by other means
• Issues in third-party dependencies with no practical exploit path in our projects (we still appreciate responsible notices)

If you research and report in good faith, without violating privacy, disrupting services or accessing data beyond what is needed to demonstrate the issue, CyberCode Labs will not pursue legal action related to that research.

CyberCode Labs — Connection. Integration. Innovation.
cybercodelabs.com.pe