The Sejong Pulse maintainers take the security of the project and its users seriously. This document explains how to report vulnerabilities and outlines the project's handling of sensitive data.

The project is under active development. Security fixes are applied to the default branch, and contributors are encouraged to track the latest revision.

Please report security vulnerabilities privately rather than through public issues or pull requests. Use one of the following channels:

• Open a private advisory through GitHub Security Advisories on the repository.
• Contact the maintainers directly through the repository's listed contact details.

When reporting, please include:

• A description of the vulnerability and its potential impact.
• Steps to reproduce, including any proof-of-concept where available.
• Affected components, versions, or configurations.

Please allow a reasonable period for the maintainers to investigate and prepare a fix before any public disclosure. The maintainers will acknowledge the report, assess the issue, and communicate the resolution timeline.

The following practices are intended to protect user credentials and secrets:

• Sejong portal passwords are used only to verify a student's identity at sign-in and are never persisted to the database.
• Credentials and API keys are kept server-side and are not written to logs.
• Secrets are supplied through environment variables and must never be committed to the repository. Variables marked sync: false in render.yaml are configured in the deployment environment.
• The eCampus agent enforces additional controls; sensitive actions are blocked by default and require explicit confirmation. See AGENT.md.

This policy applies to the application code in this repository. The vendored utility in tools/campus-auth-java/ is a standalone testing tool that retains its own upstream project's security policy.