Gold Digger follows semantic versioning. Security updates are provided for the following versions:

We take security vulnerabilities seriously. Please report any security issues you discover.

1. Go to the Security tab
2. Click "Report a vulnerability"
3. Fill out the security report form
4. Provide detailed information about the vulnerability

• Email: support@evilbitlabs.io (for urgent or highly sensitive issues)
• GitHub Issue: Use the Security Report template (public disclosure - redact sensitive details)

When reporting a vulnerability, please provide:

• Description: Clear explanation of the security issue
• Severity: Critical, High, Medium, or Low impact
• Steps to Reproduce: Detailed reproduction steps
• Proof of Concept: Minimal code demonstrating the issue (redact sensitive data)
• Affected Versions: Which versions are vulnerable
• Environment: OS, architecture, enabled features
• Impact Assessment: Potential consequences

As a single maintainer project:

• Critical/High: 24-48 hours initial response
• Medium: 3-5 business days
• Low: 1-2 weeks

Security issues are prioritized over feature development.

• Credential Protection: Database URLs and credentials are never logged
• TLS Support: Secure database connections with native TLS or rustls
• Connection Validation: Proper error handling for connection failures
• No Credential Storage: Credentials are only read from environment variables

• SQL Injection Prevention: Uses parameterized queries via mysql crate
• Environment Variable Validation: Validates required configuration
• File Path Sanitization: Validates output file paths

• File Permissions: Respects system umask for output files
• No Sensitive Data in Output: Database credentials are never included in results
• Structured Output: Safe CSV, JSON, and TSV generation

1. Use Environment Variables: Store database credentials in environment variables, not in scripts
2. Enable TLS: Use mysql:// URLs with SSL parameters for encrypted connections
3. Limit Permissions: Use database users with minimal required permissions
4. Secure Output: Store output files in secure locations with appropriate permissions
5. Regular Updates: Keep Gold Digger updated to the latest version

1. Security Reviews: All code changes undergo security review
2. Dependency Scanning: Regular vulnerability scanning with cargo audit
3. Secure Defaults: Security-focused default configurations
4. Error Handling: No sensitive information in error messages
5. Input Validation: Validate all external inputs

• CodeQL Analysis: Automated security scanning via GitHub Actions
• Dependency Scanning: Regular vulnerability checks with Dependabot
• Cargo Audit: Rust dependency vulnerability scanning
• SBOM Generation: Software Bill of Materials for supply chain security

• Code Reviews: All changes reviewed for security implications
• Penetration Testing: Periodic security testing of the application
• Configuration Audits: Regular review of security configurations

1. Private Reporting: Security issues are reported privately first
2. Coordinated Disclosure: Vulnerabilities are disclosed after fixes are available
3. CVE Assignment: Critical and high-severity issues receive CVE assignments
4. Public Disclosure: Security advisories published with fix details

• Discovery: Vulnerability is discovered and reported
• Assessment: Issue is assessed and severity determined
• Fix Development: Security fix is developed and tested
• Release: Fixed version is released
• Disclosure: Public disclosure with security advisory

• Maintainer: UncleSp1d3r
• GitHub: @unclesp1d3r
• Email: unclesp1d3r@evilbitlabs.io

This is a single-maintainer project. All security issues are handled by the primary maintainer.

We appreciate security researchers who responsibly disclose vulnerabilities. Contributors to security improvements will be acknowledged in:

• Release notes
• Security advisories
• Project documentation

• GitHub Security Policy
• Rust Security WG
• OWASP Top 10
• CVE Database

This security policy is part of the Gold Digger project and is licensed under the MIT License.