Email: charleskris9@gmail.com
Subject: [SECURITY] <brief description>

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact

We respond within 72 hours. Do not publicly disclose until we've had a chance to remediate.

• No API keys, Redis passwords, or Qdrant credentials in source (gitleaks gate, blocks all CI)
• Dockerfile scanned with hadolint on every push
• SAST via bandit (no high-severity findings permitted)
• Scope discipline enforced: Project B modules locked behind invoice gate
• All container images built from pinned base images
• Subprocesses run with empty environment (API keys never inherited)
• No bare except: clauses — all Python exceptions are typed
• Fail-safe defaults: any exception in hot path → ABORT, not silent pass