If you discover a security vulnerability in Sanctuary, please report it privately before public disclosure.

Contact: aziza@sanctuary-health.org
Subject line: [SECURITY] Sanctuary vulnerability report

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Your suggested fix if you have one

We will acknowledge reports within 48 hours and aim to resolve critical issues within 7 days.

Do not open a public GitHub issue for security vulnerabilities.

Sanctuary is designed specifically to defend against:

1. Vendor-directed subpoena — A federal or state actor compelling a cloud EHR vendor to produce Trans clients' health records. Sanctuary's edge-only architecture means no vendor has server-side access to produce.

2. Unauthorized access to unattended device — A device left unlocked. The Tier 3/4 volatile bridge token burns automatically on screen lock, system sleep, tab close, and 30-minute inactivity.

3. Data breach via cloud storage — No cloud storage exists. All data is in IndexedDB on the device.

4. Audit log tampering — SHA-256 chained audit trail makes insertion, deletion, or modification of events detectable.

Sanctuary is not designed to protect against:

• A federal search warrant served on the organization with authority to compel device access and credentials
• A staff member who is coerced into actively re-authenticating and elevating a live session
• Physical theft of the device combined with compelled credentials
• A compromised browser or OS on the device itself

If law enforcement arrives with legal process of any kind: do not touch the device, do not log in, do not elevate to sensitive records. Contact FreeState Justice or qualified legal counsel immediately.

If you receive a subpoena, court order, or other legal demand related to Sanctuary or data stored in it:

1. Do not respond without consulting legal counsel
2. Contact FreeState Justice: intake@freestate-justice.org
3. Contact Radiant Threshold: aziza@sanctuary-health.org
4. Do not destroy records in response to legal process — 18 U.S.C. § 1519 prohibits destruction of records in contemplation of a federal investigation

The Technical Incapacity defense — the truthful claim that your organization cannot produce records it has no server-side access to — is a legitimate and legally grounded response to third-party subpoenas. It requires legal counsel to assert properly.

Always use the latest release. Sanctuary does not maintain security patches for older versions.