Policy owner role: Security
Status: approval-pending
Last reviewed: 2026-07-31
Next review due: 2026-10-31
Review cadence: quarterly and after a material change

The supported product scope and versions are approval-pending. Do not infer support from repository visibility, release history, an open Issue, or this draft policy. Customer promotion remains blocked until Security approves and publishes the exact scope.

Use EnterpriseAI's approved GitHub private vulnerability reporting route. The launch renderer supplies the reviewed route and its isolated security-owned fallback before this policy is published.

Do not open or post vulnerability details in a public Issue or Discussion. Do not include exploit material, credentials, customer or tenant information, confidential diagnostics, or security-sensitive attachments in a public channel. Public editing, transfer, locking, or deletion does not restore confidentiality after disclosure.

If private vulnerability reporting is unavailable, use only the approved restricted-private fallback displayed by the published security route. Do not substitute a public Issue, Discussion, personal address, or unreviewed endpoint.

The human acknowledgement target is approval-pending. This policy does not promise a response, remediation, disclosure, or release time until Security and Legal approve explicit wording. Report state and technical detail remain inside the restricted security workflow.

Security may coordinate a customer-safe advisory after validation and approval. Public advisories never expose reporter identity, confidential evidence, or private remediation work.

Stop ordinary triage and invoke the sensitive-disclosure runbook. Preserve only the minimum reference needed for response, rotate exposed credentials when relevant, request GitHub sensitive-data removal, and publish only an approved sanitized explanation.