This policy applies to open-source repositories maintained by Javan Rasokat — security research tools, training materials, workshop apps, and community utilities.

If a repository has its own SECURITY.md, that file takes precedence.

• Conference Tracker — static site; no server-side user data
• Raceocat — security research tooling
• ya-pihole-list — blocklist automation
• LasVegasNightlifeApp-Workshop — DEF CON workshop materials
• HoneyPi — IoT firmware and installer (see also Honey-Pi org)

Do not open public GitHub issues for security vulnerabilities.

1. Open the affected repository on GitHub.
2. Go to Security → Advisories → Report a vulnerability.
3. Submit a private advisory with reproduction steps and impact.

This keeps details confidential until a fix is ready.

If private reporting is unavailable on a repository, contact via about.javan.de.

For HoneyPi-specific issues, you may also use honeys@honey-pi.de.

• Affected repository, version, or commit SHA
• Clear steps to reproduce
• Impact assessment (confidentiality, integrity, availability)
• Proof of concept, if available

Credit in advisories or release notes is offered unless you prefer to remain anonymous.

• Vulnerabilities in code, configuration, or documented deployment paths in maintained repositories
• Unsafe defaults that could harm users in realistic deployments

• Third-party hosting, CDN, or dependency infrastructure outside this codebase
• Social engineering, physical attacks, or denial-of-service without a code fix
• Issues with no realistic security impact (typos, styling, feature requests)
• Vulnerabilities in abandoned or archived repositories (report anyway — response may be limited)

Thank you for responsible disclosure.