generated: '2026-09-19'
method: searched
source: https://github.com/OrderofChaos33/SINCOR2/blob/main/SECURITY.md
raw: https://raw.githubusercontent.com/OrderofChaos33/SINCOR2/main/SECURITY.md
checked: '2026-09-19'
probe_note: >-
  probe-security-programs.py reported vdp=none because it reads /.well-known/security.txt (404 on
  getsincor.com) and bug-bounty platforms (no HackerOne/Bugcrowd/Intigriti program found). The provider DOES
  publish a vulnerability disclosure policy — as a SECURITY.md in its official open-source repository, the
  GitHub convention — so this file upgrades the probe with the searched result.
policy:
  url: https://github.com/OrderofChaos33/SINCOR2/blob/main/SECURITY.md
  channel: GitHub Security Advisories (private vulnerability reporting on the repository)
  how_to_report: 'Repository → Security tab → "Report a vulnerability"'
  contact_email: null
  pgp: null
  acknowledgement_sla: 48 hours
  assessment_sla: initial assessment within 7 days
  safe_harbor: not stated
  scope: not stated (the repository; by extension the getsincor.com runtime built from it)
  supported_versions: 'main — Active support'
  stated_measures: ['Dependency scanning and automated updates', 'Secret scanning in CI (gitleaks)', 'Rate limiting and authentication hardening', 'Regular security workflow improvements']
verbatim: >-
  "We take security seriously. If you discover a security vulnerability, please report it privately through
  GitHub Security Advisories … We will acknowledge receipt within 48 hours and aim to provide an initial
  assessment within 7 days."
security_txt:
  url: https://getsincor.com/.well-known/security.txt
  status: 404
bug_bounty: none
ci_evidence:
  - '.github/workflows/security.yml, codeql.yml, codacy.yml, pr-ci.yml in the repository tree (names only; runs not inspected)'
gaps:
  - 'No RFC 9116 security.txt on the production host, so a researcher who finds getsincor.com first has no pointer to the GitHub policy.'
  - 'No security contact email; reporting requires a GitHub account.'