If you discover a security vulnerability in this project, please report it responsibly.
Do NOT open a public GitHub issue for security vulnerabilities.
Instead, please report vulnerabilities to:
- Email: psirt@fortinet.com
- Fortinet PSIRT: https://www.fortiguard.com/psirt-policy
When reporting a vulnerability, please include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- We will acknowledge receipt within 3 business days
- We will provide an initial assessment within 10 business days
- We will work with you to understand and resolve the issue
This policy applies to the code in this repository. The scanning tools included in the Docker image (lacework/codesec) are maintained separately — please report vulnerabilities in those tools through the same Fortinet PSIRT process.
The test/sample-repo/ directory contains intentionally insecure code used to validate the scanner's detection capabilities. These are not real credentials or vulnerabilities.