# Security Policy

plexus is cryptographic networking software. We take vulnerabilities seriously.

## Reporting a vulnerability

**Do not open a public issue for security vulnerabilities.**

Report privately to the maintainers:

- Email: `security@example.invalid` *(placeholder — set before first release)*
- PGP key: *(fingerprint placeholder — publish before first release)*

You can also use GitHub's private vulnerability reporting once the repository is
public.

Please include: affected crate(s) and version, a description, reproduction steps
or a proof of concept, and any suggested remediation.

## Coordinated disclosure

- We acknowledge reports within **3 business days**.
- Coordinated disclosure window: **90 days** from acknowledgment, per
  ARCHITECTURE.md §9.3. We will work with you on timing if a fix needs longer.

## Scope and security posture

See [ARCHITECTURE.md §9](ARCHITECTURE.md) for the threat model. Headline
commitments:

- All MAC and key comparisons are constant-time (`subtle::ConstantTimeEq`).
- Private key material is zeroized on drop.
- `#![forbid(unsafe_code)]` at the workspace level; exceptions require an ADR.
- Dependencies are audited via `cargo-deny` / `cargo-audit` on every CI run.
- Pure-Rust crypto by default; no `openssl`. `ring` only behind a feature flag.
- Randomness from the operating system (`OsRng`).

## Supported versions

During the v0 / pre-1.0 phase, only the latest published version receives
security fixes.
