Security policy

Last updated: 2026-10-04

Report a vulnerability

Report security vulnerabilities affecting this repository or wavival.dev privately at wavival.dev@luminaw.co.

Do not publish security vulnerabilities in issues, pull requests, or other public channels before they are resolved.

The deployed site publishes its RFC 9116 contact at /.well-known/security.txt.

Headers, the Content Security Policy, the quote function and the supply-chain checks are described in docs/security.md.