Skip to content

SECURITY.md

Latest commit

 

History

History
63 lines (48 loc) · 1.83 KB

SECURITY.md

File metadata and controls

63 lines (48 loc) · 1.83 KB

Security Policy

Supported Versions

Version Supported
Latest ✅

Reporting a Vulnerability

If you discover a security vulnerability in Library of Pi, please report it responsibly:

🔒 Private Disclosure

  1. GitHub Security Advisory: Report privately
  2. Contact: LinkedIn

⚡ What to Include

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if you have one)

🎯 Response Timeline

  • Initial Response: Within 48 hours
  • Status Update: Within 7 days
  • Resolution: Varies by severity

✅ What We Consider In Scope

  • Authentication/authorization issues
  • Data validation vulnerabilities
  • Cross-site scripting (XSS)
  • Cross-site request forgery (CSRF)
  • Security misconfigurations
  • Dependency vulnerabilities

❌ What We Consider Out of Scope

  • Social engineering attacks
  • Physical attacks
  • Denial of service attacks
  • Issues requiring physical access
  • Issues in third-party services (APIs, hosting)

Security Measures

🛡️ Current Protections

  • Content Security Policy headers
  • XSS protection headers
  • HTTPS enforcement
  • Input validation and sanitization
  • Dependency vulnerability scanning
  • Regular security updates

🔄 Continuous Security

  • Automated dependency updates via Dependabot
  • Regular security audits
  • Code review requirements
  • Security-focused development practices

Recognition

We appreciate security researchers who help make Library of Pi safer. Valid security reports will be acknowledged in our Hall of Fame (if you wish to be listed).

Thank you for keeping Library of Pi secure! 🚀