|
| 1 | +# Security Policy |
| 2 | + |
| 3 | +## Supported Versions |
| 4 | + |
| 5 | +We actively support and provide security updates for the following versions: |
| 6 | + |
| 7 | +| Version | Supported | |
| 8 | +| ------- | ------------------ | |
| 9 | +| 0.1.x | :white_check_mark: | |
| 10 | +| < 0.1.0 | :x: | |
| 11 | + |
| 12 | +## Reporting a Vulnerability |
| 13 | + |
| 14 | +**Please do not report security vulnerabilities through public GitHub issues.** |
| 15 | + |
| 16 | +If you discover a security vulnerability, please report it via email to **team@super-agentic.ai** with the following information: |
| 17 | + |
| 18 | +* **Description**: A clear description of the vulnerability |
| 19 | +* **Impact**: The potential impact of the vulnerability |
| 20 | +* **Steps to Reproduce**: Detailed steps to reproduce the issue |
| 21 | +* **Suggested Fix**: If you have a suggested fix, please include it |
| 22 | +* **Affected Versions**: Which versions are affected |
| 23 | + |
| 24 | +### What to Expect |
| 25 | + |
| 26 | +* **Acknowledgment**: We will acknowledge receipt of your report within 48 hours |
| 27 | +* **Initial Assessment**: We will provide an initial assessment within 7 days |
| 28 | +* **Updates**: We will keep you informed of our progress |
| 29 | +* **Resolution**: We will work with you to understand and resolve the issue quickly |
| 30 | +* **Disclosure**: We will coordinate disclosure with you after the issue is resolved |
| 31 | + |
| 32 | +### Security Best Practices |
| 33 | + |
| 34 | +When reporting vulnerabilities: |
| 35 | +* Do not access or modify user data without explicit permission |
| 36 | +* Do not perform any actions that could harm users or their data |
| 37 | +* Do not disclose the vulnerability publicly until it has been resolved |
| 38 | +* Follow responsible disclosure practices |
| 39 | + |
| 40 | +## Security Updates |
| 41 | + |
| 42 | +Security updates will be released as patch versions (e.g., 0.1.1 → 0.1.2) and will be documented in the [CHANGELOG.md](../CHANGELOG.md). |
| 43 | + |
| 44 | +## Security Considerations for Contributors |
| 45 | + |
| 46 | +* Never commit secrets, API keys, or credentials |
| 47 | +* Use environment variables for sensitive configuration |
| 48 | +* Follow secure coding practices |
| 49 | +* Review dependencies for known vulnerabilities |
| 50 | +* Keep dependencies up to date |
| 51 | + |
| 52 | +Thank you for helping keep DSPy Code secure! 🔒 |
0 commit comments