This policy covers security issues involving systems, websites, repositories, integrations, and public data maintained by Hampden County Mesh.

Do not report sensitive security issues through public GitHub issues, Discord channels, comments, or social media.

Email:

security@hampdencountymesh.org

Include:

• What you found
• Where you found it
• Steps to reproduce it
• The possible impact
• Relevant screenshots or logs with unrelated private details removed

Do not send active passwords, private keys, API tokens, broker credentials, or other secrets in the initial report. Describe what may have been exposed and wait for instructions before transferring sensitive material.

Reports may involve HCM-maintained:

• Websites and GitHub repositories
• Maps and public data
• Discord bots and integrations
• Webhooks and automations
• MQTT, observer, analyzer, and logging systems
• Documentation and configuration files

Accidental exposure of credentials, private messages, personal information, administrative details, or exact private node locations is also covered.

Hampden County Mesh does not operate every node, radio, map marker, application, or service visible through regional mesh tools. Problems involving independent operators or third-party services should normally be reported to their maintainers.

Please do not:

• Publish credentials, private messages, or private locations
• Access accounts or systems without permission
• Collect more private information than needed to demonstrate the issue
• Disrupt services, community spaces, or radio systems
• Maintain access after testing
• Publicly disclose the issue before maintainers have had reasonable time to respond

Good-faith reports intended to improve project security are appreciated.

Hampden County Mesh is volunteer-run, so response times may vary. Depending on the issue, maintainers may remove exposed content, rotate credentials, disable affected systems, generalize location information, update documentation, or contact a third-party maintainer.

Information copied into Git history, caches, screenshots, messages, or third-party services may take longer to remove.