If you discover a security vulnerability, please report it responsibly:

1. Do not open a public GitHub issue for security-sensitive findings.
2. Email the maintainers with a detailed description (or open a private security advisory on GitHub when available).
3. Include steps to reproduce, affected versions, and potential impact.

We aim to acknowledge reports within 5 business days and provide a fix or mitigation plan within 30 days for confirmed issues.

This project validates local development environments. Security considerations include:

• Tests write to a dedicated service namespace (rpv-kit-validation, rpv-kit-migrated).
• Credentials are cleaned up after each test run.
• No real user secrets should be stored or transmitted.

• Outbound HTTPS requests are made to public test endpoints only.
• No user data is sent in HTTP requests.
• TLS tests intentionally connect to badssl.com to verify certificate rejection.

• Subprocess tests run platform shell commands (echo, exit) only.
• No user-controlled input is passed to subprocesses.

• All file operations use temporary directories under the system temp path.
• Temporary directories are removed after tests complete.

• Prefer well-maintained crates with active security response processes.
• Pin major versions in Cargo.toml; lockfile committed to the repository.
• Review new dependencies in pull requests for necessity and trustworthiness.
• Run cargo audit (recommended for maintainers) before releases.

• GitHub Actions workflows use pinned action versions (@v4).
• No secrets are required for standard CI runs.
• Validation artifacts contain platform info and test results only — no credentials.

• Run validation in CI or development environments, not production.
• Review generated reports before sharing — they include hostname and OS details.
• Do not commit real credentials to test configuration files.

The keyring module includes tests for:

• Missing entries (no information leakage)
• Corrupted/empty credentials
• Permission denied (skipped in automated CI)

These tests verify correct error handling, not exploitation.