mirror of
https://github.com/Rarebuffalo/securelens-backend.git
synced 2026-06-19 07:00:30 +00:00
1.8 KiB
1.8 KiB
Security Policy
We take the security of SecureLens and the codebases it scans seriously. This document details how to report vulnerabilities, which versions are supported, and our disclosure process.
Supported Versions
Security updates are actively backported to the current major version. We recommend all users upgrade to the latest stable release of SecureLens to receive security patches.
| Version | Supported |
|---|---|
| 1.x.x | Yes |
| < 1.0.0 | No |
Reporting a Vulnerability
If you discover a security vulnerability in SecureLens, please do not open a public GitHub issue. Public issues allow zero-day exploits to be used before patches are available.
Instead, report vulnerabilities through one of the following methods:
- Private Vulnerability Reporting: Submit a draft security advisory directly on GitHub via the Security tab.
- Email: Send details of the issue to security@securelens.io.
What to Include in Your Report
To help us triage and patch the issue quickly, please include:
- A detailed description of the vulnerability and its potential impact.
- Step-by-step instructions or a proof-of-concept (PoC) to reproduce the issue.
- The version of SecureLens (both backend and CLI) and dependencies used.
- Any potential mitigation steps you have identified.
Our Security Response Process
Once a vulnerability report is received:
- Acknowledgement: We will acknowledge receipt of your report within 48 hours.
- Triage: We will investigate and verify the vulnerability. We may contact you for further details or clarification.
- Patch Development: We will develop a fix for the vulnerability.
- Coordination & Disclosure: We will work with you to coordinate a release date for the security update. We aim to publish a patched release and advisory within 30 days of validation.