Do not create public GitHub issues for security vulnerabilities.
Report via email to maintainer (available on GitHub profile):
- Description of vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
Response timeline:
| Severity | Response | Fix |
|---|---|---|
| Critical | 48 hours | 7 days |
| High | 48 hours | 14 days |
| Medium | 7 days | 30 days |
| Low | 7 days | Next release |
| Version | Supported |
|---|---|
| Latest (main) | Yes |
| < 2.0 | No |
This repository uses:
- GitHub Secret Scanning
- Pre-commit hooks for local validation
- GitHub Actions for CI security checks
| Type | Examples |
|---|---|
| Credentials | Passwords, API keys, tokens |
| Keys | SSH private keys, certificates (.pem, .pfx, .key) |
| Connection strings | Database URLs with credentials |
| Real IPs | Use RFC 5737: 192.0.2.x, 198.51.100.x, 203.0.113.x |
| Personal data | Names, emails, company information |
| Practice | Implementation |
|---|---|
| Parameters | No hardcoded values in scripts |
| Templates | Use .example files for configs |
| Environment | Use .env.local (gitignored) |
| Validation | Sanitize all user input |
| Review | Check git diff before commit |
- Immediately rotate/revoke the credential
- Remove from Git history:
git filter-repo --path path/to/secret --invert-paths git push origin --force --all
- Notify collaborators to re-clone (not pull)
Last Updated: 2025-12-26 | Contact: @dashtid