If you believe you've found a security vulnerability in biometric-processor — the FastAPI face/voice/liveness inference service of the FIVUCSAS biometric authentication platform — please report it privately so we can fix it before disclosing publicly.

Email: info@fivucsas.com (primary) or rollingcat.help@gmail.com (alternate) — subject prefix: [SECURITY] biometric-processor

Please include:

• A clear description of the issue and its impact.
• Steps to reproduce, ideally with a minimal proof of concept.
• Affected versions or commit SHAs if known.
• Whether the issue is already public.

We commit to:

• Acknowledging your report within 3 business days.
• Providing a full assessment within 10 business days.
• Coordinating disclosure timing with you once a fix is ready.

In scope:

• Authentication/authorization bypass (JWT, OAuth2, refresh-token, MFA, WebAuthn).
• Account takeover or session hijacking.
• Biometric data integrity (tenant scoping, embedding-encryption-at-rest, replay).
• Multi-tenant isolation breaks.
• Server-side injection (SQL, command, log).
• Data exposure beyond the authenticated principal's tenant.

Out of scope:

• Issues requiring physical access to a user's device.
• Social-engineering of platform staff or end-users.
• Best-practice hardening recommendations without a concrete attack path (please open a regular issue).
• Self-XSS, missing security headers without exploit, clickjacking on non-state-changing pages.

Good-faith research that respects user privacy, doesn't degrade service, and follows this disclosure process is welcomed. We will not pursue legal action against researchers who follow this policy.