DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please report vulnerabilities via one of these channels:

1. Email: security@taurusai.io
2. GitHub Security Advisory: Create a private advisory

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

This project follows security best practices:

• Post-Quantum Cryptography: ML-DSA (FIPS 204) and ML-KEM (FIPS 203)
• NIST PQC Compliance: Following NIST post-quantum migration guidelines
• Dependency Scanning: Automated via Dependabot
• Code Review: All changes require review via CODEOWNERS
• Secret Management: No secrets in code; environment variables only
• Audit Trails: Immutable blockchain-anchored audit logs via Hedera HCS

The following are in scope for security reports:

• packages/core/ - SDK wrapper and authentication
• packages/api/ - Backend API server
• packages/mcp-servers/ - Hedera MCP tools
• products/gridera/web/ - Q-GRID Comply SaaS application
• products/gridera/src/crypto/ - Cryptographic implementations

Out of scope:

• Third-party dependencies (report to upstream)
• Social engineering attacks
• Denial of service attacks