The OpenProperty project takes security seriously. Because the platform handles sensitive information such as property documents, disclosures, permits, and inspection records, maintaining a strong security posture is critical.

This document describes how to responsibly report security vulnerabilities and how the project maintains security practices.

Security updates are applied to the most recent stable release of OpenProperty.

Older versions may not receive security patches. Users are strongly encouraged to run the latest version whenever possible.

If you discover a security vulnerability in OpenProperty, please do not open a public issue.

Instead, report the vulnerability privately so maintainers can investigate and address the issue before disclosure.

To report a vulnerability:

1. Send a detailed report to the project maintainers through the designated security contact listed in the repository.

2. Include as much information as possible:

   • description of the vulnerability
   • steps to reproduce
   • affected components
   • potential impact
   • proof-of-concept if available

Providing clear reproduction steps helps maintainers resolve the issue more quickly.

After submitting a vulnerability report:

1. Maintainers will acknowledge receipt of the report.
2. The issue will be investigated and validated.
3. A fix will be developed and tested.
4. A security update will be released.
5. Public disclosure may occur once users have had time to update.

Responsible disclosure helps protect users while fixes are implemented.

OpenProperty is designed with several security principles in mind.

Sensitive user data should always be protected using:

• encrypted storage
• encrypted communications
• minimal data retention policies

The project recommends enabling encryption for all document storage and communications.

Secure authentication mechanisms are required.

Recommended practices include:

• OAuth2 authentication
• secure session management
• strong password policies
• optional multi-factor authentication where supported

Because the platform analyzes uploaded documents such as disclosures, permits, and inspection reports, the following precautions are used:

• file type validation
• sandboxed document processing
• scanning for malicious files
• restricted execution environments

All dependencies should be kept up to date.

Contributors should:

• avoid introducing unnecessary dependencies
• monitor libraries for known vulnerabilities
• regularly update packages

Security researchers and developers are encouraged to help improve OpenProperty’s security.

Helpful contributions include:

• security audits
• dependency vulnerability monitoring
• authentication improvements
• encryption enhancements
• secure data handling improvements

The OpenProperty project supports responsible disclosure.

Researchers who report vulnerabilities responsibly will be credited when fixes are released unless anonymity is requested.

This security policy applies to:

• OpenProperty core platform
• HouseLens components
• TrustLens components
• official integrations maintained by the project

Third-party integrations may have separate security policies.

Security is a shared responsibility. We appreciate the efforts of contributors and security researchers who help keep OpenProperty safe and trustworthy.

OpenProperty exists to provide Transparency for Every Home, and maintaining strong security practices is an essential part of that mission.