The SeeBOM maintainers take security seriously. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, report them through one of these channels:

1. GitHub Security Advisories (preferred):
   https://github.com/seebom-labs/seebom/security/advisories/new

2. Email:
   Contact the maintainers listed in MAINTAINERS.md directly.

Please include as much of the following information as possible to help us triage your report quickly:

• Type of vulnerability (e.g. SQL injection, XSS, authentication bypass, container escape)
• Affected component(s) (API Gateway, Parsing Worker, UI, Helm Chart, ClickHouse schema)
• Full paths of affected source file(s)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact assessment (what an attacker could achieve)

We will work with you to understand and validate the report. Once confirmed, we will:

1. Develop a fix in a private branch
2. Assign a CVE identifier if appropriate
3. Release a patched version
4. Publish a security advisory on GitHub

We follow the CVSS v3.1 scoring system:

When deploying SeeBOM, pay attention to:

• ClickHouse credentials: Always change the default password. Use the seebom-secret Kubernetes Secret.
• UI is public: The Angular frontend has no authentication. Do not expose it to the internet without an authentication proxy (e.g. OAuth2 Proxy, Pomerium).
• License exceptions are read-only: By design, no API endpoint can modify license exceptions or policy — they are loaded from config files to prevent tampering via the public UI.
• SBOM source directory: Ensure only trusted SBOM/VEX files are placed in the ingestion directory. Malicious JSON payloads could attempt to exploit the parsers.
• Container images: All backend containers run as nobody:nobody. The UI runs as the nginx user. No container requires root privileges.
• Network policies: In production, restrict ClickHouse access to only the SeeBOM pods.

• We follow coordinated vulnerability disclosure.
• We will credit reporters in the security advisory unless they prefer to remain anonymous.
• We ask that you give us reasonable time to address the issue before public disclosure.
• We will not take legal action against researchers who follow this policy.

SeeBOM has not yet undergone a formal security audit. If you are interested in sponsoring or conducting one, please reach out to the maintainers.

Thank you for helping keep SeeBOM and its users safe.