captchaforge 0.2.36

# captchaforge Security Bounty Program

captchaforge runs an open responsible-disclosure program. Find a
vulnerability → email or open a GitHub Security Advisory → we
acknowledge within 48 hours and ship a fix within 30 days.

## In Scope

- **The `captchaforge` crate** (lib + cli + bench + challenge +
  rules-crate workspace members) at the version in the current
  `Cargo.toml`.
- **The bundled `rules/community.toml` rule pack** — including
  any way a malicious rule pack can escape the data-only loader
  contract (e.g. JS injection through `serde_json::to_string`-
  escaped values, selector injection breaking out of the probe
  context).
- **The Python and Node bindings** in `bindings/python/`,
  `bindings/node/`.
- **The WASM build** in `bindings/wasm/`.
- **The container image** at `ghcr.io/santhsecurity/captchaforge`.
- **The Helm chart** in `deploy/charts/captchaforge`.
- **The HTTP `serve` API surface** including SSRF/auth/rate-limit
  bypasses, body-cap evasion, CORS bypass, JSON-extractor abuse.
- **The bench fixture server** — fixture-side cheats that
  invalidate measurements (per the CLAUDE.md ANTI-RIGGING LAW).

## Out of Scope

- **chromiumoxide / tokio / reqwest / rustls / serde** upstream
  dependencies. Report those to the upstream maintainers.
- **The captchaforge-chromium patched-binary fork** (separate
  repo; has its own SECURITY.md).
- **Third-party CAPTCHA-solving services** (2captcha, CapSolver,
  CapMonster) called by `ThirdPartyCaptchaSolver`. Those are
  external SaaS; report directly to the vendor.
- **Vendor anti-bot countermeasures themselves** (Cloudflare,
  Akamai, hCaptcha, …). captchaforge defeats CAPTCHAs; if a
  vendor strengthens their countermeasures we adapt, but a
  vendor strengthening is not a vulnerability in captchaforge.
- **Social-engineering** the maintainers.

## Reward Tiers

We do not run a paid program (open-source, no funding). Recognition:

| Severity | Recognition |
|----------|-------------|
| CRITICAL | GHSA + CVE + author credit on README + release notes |
| HIGH     | GHSA + author credit on release notes |
| MEDIUM   | author credit on release notes |
| LOW      | thanks in CHANGELOG |

When budget allows we may add cash bounties via the
[GitHub Sponsors](https://github.com/sponsors/santhsecurity) page
funding the captchaforge project. Watch this file for updates.

## Process

1. Find a vuln matching the in-scope list.
2. Report via:
   - **Preferred**: GitHub Security Advisory at
     <https://github.com/santhsecurity/captchaforge/security/advisories>
     (click "Report a vulnerability"). Filing a draft GHSA gives
     us a private comment thread + automatic CVE-issuance pipeline.
   - **Alternative**: `security@santh.dev` (PGP key fingerprint
     `TBD — published before first paid bounty`).
3. **Do NOT** open a public GitHub issue. Disclosure stays
   embargoed until the patch ships.
4. We respond within 48 hours, reproduce within 7 days, ship a
   fix release within 30 days.
5. After the fix ships, you publish whatever writeup / blog post
   / talk you want — and we'll link to it from the release notes.

## Hall of Fame

- [empty] — be the first.

## Service-Level Objectives

| Event | Target |
|-------|--------|
| Acknowledgement | ≤ 48 hours |
| Reproduction confirmation | ≤ 7 days |
| Patch shipped to crates.io | ≤ 30 days |
| GHSA / CVE published | ≤ 48 hours after patch lands |
| Backport to previous 0.2.x line | only critical/high; ≤ 7 days |

If we miss any of these without communicating, file a follow-up
report citing the missed SLO — we treat that as a separate triage
item.