name: Security Vulnerability
description: Report a security vulnerability (private disclosure preferred)
title: "[Security]: "
labels: ["security", "triage"]
body:
  - type: markdown
    attributes:
      value: |
        ⚠️ **IMPORTANT**: For serious security vulnerabilities, please report privately via GitHub Security Advisories or email instead of creating a public issue.
        
        [Report a security vulnerability privately →](https://github.com/imran-siddique/agent-control-plane/security/advisories/new)
  
  - type: textarea
    id: vulnerability
    attributes:
      label: Vulnerability Description
      description: Describe the security issue you've discovered
      placeholder: The system allows...
    validations:
      required: true
  
  - type: dropdown
    id: severity
    attributes:
      label: Severity Assessment
      description: How severe do you think this vulnerability is?
      options:
        - Critical - Remote code execution, data breach
        - High - Privilege escalation, authentication bypass
        - Medium - Information disclosure, DoS
        - Low - Minor security improvement
    validations:
      required: true
  
  - type: textarea
    id: impact
    attributes:
      label: Impact
      description: What is the potential impact of this vulnerability?
      placeholder: An attacker could...
    validations:
      required: true
  
  - type: textarea
    id: reproduction
    attributes:
      label: Steps to Reproduce
      description: How can we reproduce this issue? Please be as specific as possible.
      placeholder: |
        1. Configure agent with...
        2. Send request...
        3. Observe...
    validations:
      required: true
  
  - type: textarea
    id: affected
    attributes:
      label: Affected Versions
      description: Which versions are affected?
      placeholder: "e.g., 1.0.0 - 1.1.0, or all versions"
    validations:
      required: true
  
  - type: textarea
    id: mitigation
    attributes:
      label: Suggested Mitigation
      description: If you have ideas for fixing this, please share
  
  - type: textarea
    id: references
    attributes:
      label: References
      description: Any relevant CVEs, research papers, or similar vulnerabilities
  
  - type: checkboxes
    id: disclosure
    attributes:
      label: Disclosure
      options:
        - label: I understand this will be publicly visible (consider private disclosure for serious issues)
          required: true
        - label: I am willing to work with maintainers on coordinated disclosure
