Security policy

Report vulnerabilities privately at https://github.com/lorenzobrg/yggdrasil4/security/advisories/new. The same contact is in security.txt.

Yggdrasil protects medical data with client-side de-identification and end-to-end encryption, so security reports matter to us.

Reporting a vulnerability

Report vulnerabilities privately through GitHub’s private vulnerability reporting on this repository (Security → Report a vulnerability). Do not open a public issue, pull request or discussion.

Please include the affected component and version or commit, steps to reproduce, and the impact you expect. We acknowledge reports within 5 working days and agree on a disclosure date with you once a fix is available.

Supported versions

Only the main branch is supported.

Scope

In scope: the web app, the API, the processor SDK, the YGG1 container format and key management, de-identification, and the deployment configuration in deploy/.

The documented limits in the specification (visible metadata such as sizes, counts and timing; an operator who could serve altered JavaScript; data cached by removed members) are known trade-offs. Reports that show those limits being exceeded are in scope.