From f3cd3ffc40f5a1afd3fbadc4efefa4fd503acf8e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 10:42:42 +1100 Subject: [PATCH 1/2] docs: add SECURITY.md from the 2026-10-04 draft (#57) Draft as approved on 2026-10-04 with the 'last audited' field added. The reporting address is a REPLACE_ME placeholder until the dedicated address exists; do not merge before it is filled in. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019YPoXzBSj89ZHgw7nfTmbB --- SECURITY.md | 94 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..45a09f2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,94 @@ +# Security Policy + +## Supported Versions + +This project is actively maintained on the `main` branch. Security +fixes are applied to `main` and any current release tag. Older +tags are not supported — if you're running an older version, +upgrade to the latest release before reporting. + +| Version | Supported | +| ------------- | ------------------ | +| main (HEAD) | :white_check_mark: | +| Latest tag | :white_check_mark: | +| Older tags | :x: | + +## Reporting a Vulnerability + +If you believe you've found a security vulnerability in this +project, please report it privately. Do not open a public issue. + +**Email:** REPLACE_ME + +Please include, where possible: + +- A description of the vulnerability +- Steps to reproduce (or a proof-of-concept) +- The commit SHA or release tag you tested against +- Any suggested remediation + +PGP encryption is not currently offered. If you need to send +sensitive details, let me know in your first email and we'll +agree a secure channel. + +## Response Commitment + +As a solo-maintainer project, these timeframes are best-effort +commitments. + +- **Acknowledgement:** within 72 hours of receipt +- **Initial triage:** within 7 days +- **Fix target** (depending on severity): + - Critical: 30 days + - High: 60 days + - Medium: 90 days + - Low: next scheduled release +- **Disclosure:** coordinated with the reporter; standard + practice is public disclosure within 90 days of the fix + being released, or sooner if the reporter prefers + +If a fix takes longer than the target (for example, a complex +remediation or a dependency on an upstream change), I'll keep +you updated and agree a revised timeline with you. + +## Scope + +The following are considered in-scope for this policy: + +- Source code in this repository +- Infrastructure-as-code (`infra/`) that is deployed as part + of this project +- Dependencies pinned in `api/requirements.txt` where the + vulnerability affects this project's use of them + +The following are **out of scope**: + +- Third-party services this project integrates with (report + to their maintainers directly) +- Social-engineering attacks against the author +- Denial-of-service findings that depend on exhausting a + shared cloud resource (e.g. Azure quota limits) +- Known limitations already documented in the README under + "Known Limitations" — report these as regular issues + +## Safe Harbour + +I will not pursue legal action against security researchers who: + +- Make a good-faith effort to avoid privacy violations, + destruction of data, or interruption of service +- Report findings through the channel above before public + disclosure +- Give reasonable time for the issue to be addressed before + going public + +## Hall of Thanks + +Researchers who report valid security issues will be credited +in release notes (unless they prefer to remain anonymous). + +--- + +*This policy is adapted from standard open-source security +conventions. Last updated: 2026-10-26. Last audited: 2026-10-26 +(reviewed quarterly, even when nothing changes).* From 74d1408b2af6fda6fce8387fb91bde137e3c4477 Mon Sep 17 00:00:00 2001 From: amar-python Date: Tue, 3 Nov 2026 15:13:34 +1100 Subject: [PATCH 2/2] docs(security): add placeholder reporting address (part of #57) Replaces REPLACE_ME with singhofoz@gmail.com as a working placeholder. HTML comment inline notes it's a placeholder pending the dedicated org security@ address. #57 stays open until the proper address lands. --- SECURITY.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 45a09f2..407e479 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -18,7 +18,8 @@ upgrade to the latest release before reporting. If you believe you've found a security vulnerability in this project, please report it privately. Do not open a public issue. -**Email:** REPLACE_ME + +**Email:** singhofoz@gmail.com Please include, where possible: