Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in GovLens, please report it responsibly:

• Email: [email protected]
• Do not disclose the vulnerability publicly until we have had a chance to address it
• We aim to acknowledge reports within 48 hours
• We aim to provide a fix within 7 days for critical issues

Scope

The following are in scope for security reports:

• govlens.eu and all subdomains
• The GovLens API (api.govlens.eu)
• Authentication and session management
• Citizen data privacy and encryption
• Position voting integrity

Our Commitments

• We will not take legal action against researchers who report vulnerabilities responsibly
• We will acknowledge your contribution (unless you prefer to remain anonymous)
• We will publish a post-mortem within 72 hours of resolving critical vulnerabilities

Data Protection

Citizen identity and voting positions are stored in separate database schemas with no direct foreign key relationship. The link between identity and positions uses a one-way HMAC that requires a server-side secret to compute. See our Privacy Policy for full details.