If you discover a security vulnerability in OSCAL4Rail, please report it privately so we can address it before it is disclosed publicly.

Preferred channel: Use GitHub's private vulnerability reporting for this repository:

1. Go to the Security tab of this repository.
2. Select Report a vulnerability.
3. Describe the issue, affected versions, and reproduction steps.

Please do not open a public issue for security problems.

• A description of the vulnerability and its potential impact.
• Steps to reproduce or a proof of concept.
• Affected files, versions, or configurations.

The maintainers will acknowledge your report, assess the issue, and keep you informed about the remediation. Once a fix is available, we will coordinate disclosure with you.

This policy covers the OSCAL4Rail framework, schemas, and tooling in this repository. The NIST OSCAL base schemas (schemas/nist/) are maintained upstream by NIST; vulnerabilities in the OSCAL standard itself should be reported to the NIST OSCAL project.