Please do not open a public GitHub issue for security vulnerabilities.

Email us at: security@aptsecuritymanagement.com

Include:

• Description of the vulnerability and its potential impact
• Steps to reproduce
• Any proof-of-concept code or screenshots (if applicable)
• Your name/handle for acknowledgment (optional)

We will acknowledge receipt within 2 business days and aim to release a fix within 14 days for confirmed vulnerabilities.

This is a client-side only application. All POA&M data is processed and stored entirely in the user's browser (localStorage). No data is transmitted to any server unless the user explicitly submits the Zoho CRM contact form (controlled by the VITE_CTA_EMBED_HTML environment variable).

In scope:

• Cross-site scripting (XSS) via user-supplied input rendered in the UI
• Malicious .json state files that exploit the drag-and-drop restore feature
• Dependency vulnerabilities (supply chain)
• Logic errors in regulatory validation that could mislead CMMC assessment decisions

Out of scope:

• Denial of service against client-side browser applications
• Social engineering attacks on end users
• Issues in third-party Zoho CRM embed (report to Zoho directly)

We maintain a zero high/critical CVE policy in production dependencies:

• The xlsx package is explicitly banned due to unfixable high-severity CVEs; we use exceljs instead
• npm audit is checked on every build; moderate-severity vulnerabilities are reviewed case-by-case

We appreciate responsible disclosure. Reporters of confirmed vulnerabilities will be credited in release notes (with their permission).