If you discover a security vulnerability in this project, please report it responsibly:

Instead, please:

1. Email: Send details to [email protected]
2. Subject Line: Include "SECURITY: isomdl-uniffi vulnerability report"
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Initial Response: Within 48 hours
• Investigation: 7-14 days for assessment
• Fix Timeline: Critical issues addressed within 7 days, others within 30 days
• Disclosure: Coordinated disclosure after fix is available

This library handles sensitive cryptographic operations and personal identity data. Key security areas include:

• Key generation and management
• Digital signatures (ECDSA)
• Certificate validation
• Random number generation

• Mobile Driver's License (mDL) documents
• Personal Identifiable Information (PII)
• Biometric data references
• Session management

• Rust's memory safety guarantees
• Foreign Function Interface (FFI) boundaries
• Python memory management
• Kotlin/JVM memory management and garbage collection

1. Key Management:

   • Use hardware security modules (HSMs) when available
   • Rotate keys regularly
   • Secure key storage

2. Data Protection:

   • Encrypt sensitive data at rest
   • Use secure channels for transmission
   • Implement proper access controls

3. Validation:

   • Always validate certificates
   • Verify digital signatures
   • Check data integrity

4. Updates:

   • Keep dependencies updated
   • Monitor security advisories
   • Apply patches promptly

1. Pre-1.0 Status: This library is pre-1.0 and has not undergone formal security audit
2. Cryptographic Dependencies: Security depends on underlying Rust crates
3. FFI Boundaries: Extra care needed at Rust-Python boundaries

We follow responsible disclosure practices:

1. Acknowledgment: Security researchers will be credited (unless they prefer anonymity)
2. Timeline: We coordinate with reporters on disclosure timeline
3. Advisory: Security advisories published through GitHub Security Advisory

For security-related questions or concerns:

• Email: [email protected]
• General Issues: Create a public GitHub issue (non-security related only)

Thank you for helping keep the ISO MDL UniFFI project secure!