HEAV3NS-PRESS takes the security of autonomous publishing systems seriously.

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability or exploit vector in HEAV3NS-PRESS:

1. Email security findings privately to security@heav3ns.press or contact the core maintainers via private channels.
2. Include a detailed proof-of-concept, steps to reproduce, affected platform/OS, and potential impact.
3. Allow up to 48 hours for acknowledgment from the core architecture team.

HEAV3NS-PRESS enforces defense-in-depth across multiple surfaces:

1. Zero Dynamic Plugins: Third-party plugin execution and arbitrary code execution vectors are completely eliminated by architectural design (ADR-0001).
2. Cryptographic CAS: Content bodies and binary assets are stored in SHA-256 addressed shards, detecting tampering or bitrot on read (ADR-0004).
3. Lexical Path Traversal Protection: Slugs are whitelisted via strict regular expressions (^[a-z0-9]+(-[a-z0-9]+)*$) and checked against reserved system routes (PM-005).
4. Non-Destructive Quarantine: Damaged records are isolated into a dedicated quarantine area preserving raw forensic bytes intact without data loss (ADR-0005).
5. Bounded Resource Limits: Maximum body size, slug length, and tags are validated prior to storage mutation.

For detailed threat models and architectural mitigations, see docs/SECURITY_BEST_PRACTICES.md.