BioRouter handles genomic data on behalf of real patients. We take security and privacy issues seriously.

Do NOT file a public GitHub issue for security or privacy vulnerabilities.

Send a private report to:

daniel@genobank.io
Subject: [SECURITY] <short description>

For privacy-specific issues (PII leaks, HIPAA/GDPR concerns, wallet correlation attacks), use the subject line [PRIVACY] instead.

We aim to respond within 48 hours and to provide a status update within 7 days.

• A clear description of the issue
• Steps to reproduce
• Affected file(s) and line(s), if known
• Suggested severity (Low / Medium / High / Critical)
• Whether you have disclosed this elsewhere

In-scope:

• The source code in this repository
• The runtime behavior of the demo (python cli.py demo ...)
• The deterministic decompiler
• The BioRouter access gate logic
• The privacy audit script (scripts/privacy_audit.py)

Out-of-scope (for THIS repository — but still reportable via the same address):

• The live BioRouter production service at biorouter.genobank.app
• The live cancer map at genoclaw.genobank.app
• Sequentia blockchain node operations
• The Cancer Map visualization

For out-of-scope items, we will route your report to the appropriate team.

If you report a vulnerability in good faith, we will:

1. Not initiate legal action against you for your research.
2. Credit you in the fix commit and release notes (unless you prefer anonymity).
3. Work with you on a reasonable disclosure timeline.

• The demo wallet 0x00000000000000000000000000000000DEADBEEF: this is a deliberate, documented synthetic constant. See PRIVACY.md.
• The synthetic agent did:erc8004:sequentia:demo-agent: deliberate fixture. Not a real production agent.
• The simulated USDC address 0x000000000000000000000000000000000005DCC0: not a real token contract.
• samples/autogene-cevumeran-phase2-informed-consent.md: references real public trial identifiers (NCT05968326, BO44158) but contains no patient-specific PII. This is a synthesized template.