|
| 1 | +# Security Policy |
| 2 | + |
| 3 | +## Supported Versions |
| 4 | + |
| 5 | +| Version | Supported | |
| 6 | +| ------- | ------------------ | |
| 7 | +| 0.1.x | :white_check_mark: | |
| 8 | + |
| 9 | +## Reporting a Vulnerability |
| 10 | + |
| 11 | +We take security seriously. If you discover a security vulnerability, please report it responsibly. |
| 12 | + |
| 13 | +### How to Report |
| 14 | + |
| 15 | +1. **Do NOT** create a public GitHub issue for security vulnerabilities |
| 16 | +2. Email security concerns to: [your-email@example.com] |
| 17 | +3. Include as much detail as possible: |
| 18 | + - Description of the vulnerability |
| 19 | + - Steps to reproduce |
| 20 | + - Potential impact |
| 21 | + - Suggested fix (if any) |
| 22 | + |
| 23 | +### What to Expect |
| 24 | + |
| 25 | +- **Acknowledgment**: Within 48 hours of your report |
| 26 | +- **Assessment**: Within 7 days, we'll assess the vulnerability and determine its severity |
| 27 | +- **Resolution**: We aim to resolve critical vulnerabilities within 30 days |
| 28 | +- **Disclosure**: We'll coordinate with you on public disclosure timing |
| 29 | + |
| 30 | +### Scope |
| 31 | + |
| 32 | +Security issues we're interested in: |
| 33 | + |
| 34 | +- Authentication/authorization bypasses |
| 35 | +- Code injection vulnerabilities |
| 36 | +- Sensitive data exposure |
| 37 | +- Cryptographic weaknesses |
| 38 | +- Unsafe handling of API credentials |
| 39 | + |
| 40 | +### Out of Scope |
| 41 | + |
| 42 | +- Denial of service attacks |
| 43 | +- Social engineering |
| 44 | +- Physical attacks |
| 45 | +- Issues in dependencies (report to upstream) |
| 46 | + |
| 47 | +### Safe Harbor |
| 48 | + |
| 49 | +We consider security research conducted in good faith to be authorized. We will not pursue legal action against researchers who: |
| 50 | + |
| 51 | +- Make a good faith effort to avoid privacy violations and disruption |
| 52 | +- Provide us reasonable time to fix the issue before public disclosure |
| 53 | +- Do not exploit the vulnerability beyond what's necessary to demonstrate it |
| 54 | + |
| 55 | +## Security Best Practices for Users |
| 56 | + |
| 57 | +### API Credentials |
| 58 | + |
| 59 | +- Never commit API keys to version control |
| 60 | +- Use environment variables for sensitive data |
| 61 | +- Rotate API keys regularly |
| 62 | +- Use paper trading mode for testing |
| 63 | + |
| 64 | +### Configuration |
| 65 | + |
| 66 | +- Keep configuration files private |
| 67 | +- Don't share configuration with API secrets |
| 68 | +- Use appropriate file permissions |
| 69 | + |
| 70 | +### Running the Application |
| 71 | + |
| 72 | +- Run with minimal required permissions |
| 73 | +- Monitor for unusual activity |
| 74 | +- Keep the application updated |
| 75 | + |
| 76 | +## Acknowledgments |
| 77 | + |
| 78 | +We appreciate the security research community and will acknowledge researchers who help improve our security (with their permission). |
0 commit comments