# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability within this project, please send an e-mail to **tiago.peczenyj+cpan@gmail.com**.

All security vulnerabilities will be promptly addressed. We request that you do not report security-related issues through public GitHub issues.

## Supply Chain Security

This project targets [SLSA](https://slsa.dev/) **Build Level 1**. Every release produces signed [build provenance](https://slsa.dev/provenance/) — a document describing how each artifact was built — generated by the `Release` GitHub Actions workflow and stored in GitHub's attestation store.

Provenance is generated for both published artifacts:

- the CPAN distribution tarball (`GDPR-IAB-TCFv2-*.tar.gz`), and
- the Docker image (`docker.io/peczenyj/GDPR-IAB-TCFv2`).

### Verifying provenance

With the [GitHub CLI](https://cli.github.com/) installed, you can verify that an artifact was built by this repository's release workflow:

```sh
# CPAN distribution tarball (downloaded from the GitHub Release)
gh attestation verify GDPR-IAB-TCFv2-X.Y.tar.gz --repo peczenyj/GDPR-IAB-TCFv2

# Docker image
gh attestation verify oci://docker.io/peczenyj/GDPR-IAB-TCFv2:vX.Y --repo peczenyj/GDPR-IAB-TCFv2
```

Replace `X.Y` with the release version.
