• Report security issues to: security@damagebdd.com (PGP preferred).
• Do not file public GitHub issues for sensitive reports.
• We aim to acknowledge within 72 hours and provide regular updates.
• Coordinated disclosure by default; see Timeline & Process.

Security issues in:

• DamageBDD core (Erlang/OTP app, libraries, rebar.config toolchain).
• Official Docker images, release artifacts, installers, example configs.
• Public *.damagebdd.com services (e.g., run.damagebdd.com, API endpoints).
• Example infrastructure artifacts (e.g., damagebdd.conf for Nginx).

Out of scope (unless a vulnerability causes impact to the above):

• 3rd‑party services (cloud providers, CDNs, OS packages we do not maintain).
• Experimental branches, forks outside the DamageBDD/* org.
• Misconfigurations outside documented guidance (“won’t fix” if not a defect).

We support good‑faith security research. If you:

• Access only to the extent necessary to prove an issue,
• Avoid privacy violations, disruption, or data exfiltration,
• Report promptly with details to security@damagebdd.com,

we will not initiate legal action against you for the research activities described in your report.

Please include where possible:

• Affected component/version and environment (OS, Erlang/OTP version).
• Reproduction steps, PoC or exploit details (safe & minimal).
• Expected vs. actual behavior and impact (confidentiality/integrity/availability).
• Network/port details (esp. Erlang/EPMD/4369, node distribution, HTTP ports).
• Mitigations or workarounds if you know them.
• Whether the issue is exploitable over default settings.

Encrypt with the security team key (preferred).

1. Acknowledgement within 72 hours (business days).
2. Triage and assign CVE/CVSS prelim score when applicable.
3. Remediation planning with target fix window based on severity.
4. Coordinated disclosure with you; we share prerelease patches/advisories.
5. Public advisory with credit (if desired), patches and mitigations.
6. Post‑mortem notes may be published for high‑impact incidents.

We use CVSS v3.1 as a reference for severity:

• Critical: RCE, auth bypass, supply‑chain compromise, default‑on exposure.
• High: Privilege escalation, SSRF to sensitive planes, key leakage.
• Medium: Information disclosure, DoS requiring unusual conditions.
• Low: Hardening gaps, best‑practice deviations.

We may adjust based on real‑world exploitability in typical DamageBDD deployments.

• Network exposure: bind verification node to 127.0.0.1 and proxy via Nginx.
• TLS: Use Let’s Encrypt (or equivalent); monitor renewals.
• Erlang distribution: Do not expose EPMD (4369) or Erlang distribution ports publicly.
• Users & permissions: run as a dedicated damagebdd user; least privilege FS permissions.
• Secrets: store via secrets:encrypt_store/2; never commit secrets to VCS.
• Nginx: enable rate‑limits; consider fail2ban; separate static and API vhosts.
• Logging: centralize and monitor (journalctl -u damagebdd, Nginx logs).
• Updates: patch OS, Erlang/OTP, Nginx, IPFS, and DamageBDD regularly.
• Resource limits: set LimitNOFILE and CPU/memory quotas in systemd.
• Backups: back up sys.config, secrets vault, and operator keys securely.
• SBOM & supply chain: pin dependency versions; verify release signatures.

• We request a reasonable period for remediation prior to public release.
• By default we target: Critical ≤ 14 days, High ≤ 30 days, Medium ≤ 60 days, Low ≤ 90 days.
• We will coordinate public advisories, patches, and credits with you.

All public advisories will be indexed on this page and mirrored in the repository (SECURITY.advisories/). Each advisory includes affected versions, impact, fixes, mitigations, and acknowledgments.

We thank independent researchers and community members who report responsibly. If you wish to be credited, include your preferred name/handle and link.

We also publish a machine‑readable /.well-known/security.txt aligned with RFC 9116.

Contact: mailto:security@damagebdd.com
Expires: 2026-12-31T23:59:59Z
Encryption: https://damagebdd.com/security#gpg--pgp-public-keys-placeholders
Policy: https://damagebdd.com/security
Hiring: https://damagebdd.com/hiring

• No warranties. Use of DamageBDD is at your own risk.
• Safe harbor for good‑faith research as described above.
• Export and compliance obligations remain your responsibility.