SECURITY.md

Security Policy

Reporting a Vulnerability to the VA.gov CMS

If you believe you have found a vulnerability in this repository, please report it here. Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.

Reporting vulnerabilities to public-facing VA systems

Please see VA's Vulnerability Disclosure Policy.