🔒 Black Trigram (흑괘) — Security Policy

🛡️ Responsible Disclosure and Vulnerability Management
🎯 Protecting Users Through Transparent Security Practices

---

Security Policy

Supported Versions

This project is under active development, and we provide security updates for the latest version only. Please ensure you're using the latest version of the project to receive security updates.

Version	Supported
latest	:white_check_mark:

Reporting a Vulnerability

We take the security of the Black Trigram (흑괘) project seriously. If you have found a potential security vulnerability, we kindly ask you to report it privately, so that we can assess and address the issue before it becomes publicly known.

What Constitutes a Vulnerability

A vulnerability is a weakness or flaw in the project that can be exploited to compromise the security, integrity, or availability of the system or its data. Examples of vulnerabilities include, but are not limited to:

• Unauthenticated access to sensitive data
• Injection attacks (e.g., SQL injection, cross-site scripting)
• Insecure defaults or configurations
• Insufficient access controls
• Remote code execution

How to Privately Report a Vulnerability using GitHub

Please follow these steps to privately report a security vulnerability:

1. On GitHub.com, navigate to the main page of the Black Trigram repository.
2. Under the repository name, click Security. If you cannot see the "Security" tab, select the dropdown menu, and then click Security.
3. In the left sidebar, under "Reporting", click Advisories.
4. Click Report a vulnerability to open the advisory form.
5. Fill in the advisory details form. Provide as much information as possible to help us understand and reproduce the issue.
6. At the bottom of the form, click Submit report.

After you submit the report, the maintainers of the game repository will be notified. They will review the report, validate the vulnerability, and take necessary actions to address the issue. You will be added as a collaborator and credited for the security advisory.

Disclosure Timeline

Upon receipt of a vulnerability report, our team will:

1. Acknowledge the report within 48 hours
2. Validate the vulnerability within 7 days
3. Develop and release a patch or mitigation within 30 days, depending on the complexity and severity of the issue
4. Publish a security advisory with a detailed description of the vulnerability and the fix

Recognition and Anonymity

We appreciate your effort in helping us maintain a secure and reliable project. If your report results in a confirmed security fix, we will recognize your contribution in the release notes and/or a public acknowledgment, unless you request to remain anonymous.

Thank you for helping us keep the game project and its users safe.

---

🛡️ Supply Chain Security

Black Trigram applies defense-in-depth supply-chain controls aligned with the Hack23 Open Source Policy, Vulnerability Management Policy, and Secure Development Policy:

Control	Implementation	Workflow
OSSF Scorecard	Automated weekly scoring; SARIF uploaded to GitHub code scanning and results published to the OpenSSF API	scorecards.yml
OpenSSF Best Practices	Project ID 10777 maintained at passing tier	bestpractices.dev/projects/10777
SLSA Level 3 Provenance	Every release ships a signed intoto.jsonl build attestation	/attestations
CycloneDX SBOM	SPDX + CycloneDX SBOM published with every GitHub Release	release.yml
CodeQL SAST	Pull-request and weekly scheduled runs across JavaScript/TypeScript	codeql.yml
OWASP ZAP DAST	Active dynamic scan against the deployed game on each release	zap-scan.yml
Lighthouse Performance & Security	Best-practices, performance, accessibility, SEO budgets enforced	lighthouse-performance.yml
Accessibility (WCAG 2.1 AA)	Automated axe-core checks on every PR	accessibility-test.yml
Dependency Review	GitHub Dependency Review on every PR; blocks high-severity vulns	dependency-review.yml
Dependabot	Weekly updates with auto-merge for low-risk patches	.github/dependabot.yml
Pinned GitHub Actions	All third-party actions pinned to commit SHAs	WORKFLOWS.md
Signed commits	All maintainer commits signed with verified GPG/SSH keys	Access Control Policy
Hardened runners	step-security/harden-runner enforced on every workflow	All workflows
Asset audit	Image, audio, and video assets scanned for license/integrity	audit-assets.yml

📊 Live status: see the consolidated badge wall in README.md and the full pipeline catalogue in WORKFLOWS.md.

---

🔐 Security Documentation & ISMS

For comprehensive security documentation and our Information Security Management System (ISMS):

• 📋 ISMS-PUBLIC Repository - Complete ISMS framework, policies, and procedures
• 🗺️ ISMS Reference Mapping - Complete mapping of ISMS policies referenced by Black Trigram
• 🛡️ Threat Model - Security threat analysis and risk assessment
• 📋 CRA Assessment - EU Cyber Resilience Act compliance
• 🏗️ Security Architecture - Current security implementation

Our commitment to transparency means all security policies, risk assessments, and compliance documentation are publicly available for review.

---

📚 Related Documents

🔐 Core ISMS Policies

• 🔐 Information Security Policy - Overall security governance
• 🔍 Vulnerability Management - Security testing and remediation procedures
• 🚨 Incident Response Plan - Security incident handling
• 🛠️ Secure Development Policy - Security-integrated SDLC practices
• 🏷️ Classification Framework - Business impact and risk assessment

🛡️ Black Trigram Security Documentation

• 🛡️ Security Architecture - Current security implementation
• 🔮 Future Security Architecture - Planned security enhancements
• 🎯 Threat Model - STRIDE analysis and attack trees
• 📋 CRA Assessment - EU Cyber Resilience Act compliance
• 🗺️ ISMS Reference Mapping - Complete ISMS policy mapping
• 📅 End-of-Life Strategy - Security patching and support lifecycle

🔄 Development & Operations

• 🔄 Workflows - Security-hardened CI/CD pipelines
• 🔧 Development Guide - Security features and testing strategy
• 📝 Change Management - Risk-controlled change processes

🤝 Third-Party & Transparency

• 🤝 Third Party Management - Supplier security assessment
• 🌐 ISMS Transparency Plan - Public disclosure strategy
• 🔓 Open Source Policy - Open source governance

---

📋 Document Control:
✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification:
📅 Effective Date: 2026-04-21
⏰ Next Review: 2026-07-21
🎯 Framework Compliance: