If you discover a security vulnerability in any StreamlineLabs repository, please report it responsibly.
DO NOT open a public GitHub issue for security vulnerabilities.
Email security@streamlinelabs.dev with:
- Description of the vulnerability
- Steps to reproduce
- Affected repository and version
- Potential impact assessment
- Any suggested remediation (optional)
| Action | Timeline |
|---|---|
| Acknowledgment | Within 48 hours |
| Initial assessment | Within 5 business days |
| Fix development | Depends on severity |
| Public disclosure | After fix is deployed |
| Severity | Description | Target Fix Time |
|---|---|---|
| Critical | Remote code execution, authentication bypass, data exfiltration | 24 hours |
| High | Privilege escalation, significant data exposure | 72 hours |
| Medium | Limited data exposure, denial of service | 2 weeks |
| Low | Minor information disclosure, best-practice violations | Next release |
This policy applies to all repositories under the StreamlineLabs organization, including but not limited to:
- Core server (
streamline) - Client SDKs (Java, Python, Go, Node.js, Rust, .NET, Kotlin, Swift, WASM)
- Infrastructure (operator, Terraform provider, Helm charts, Docker images)
- Cloud control plane (
streamline-cloud) - Documentation and tooling (docs site, VS Code extension, desktop app)
Individual repositories may have additional security policies in their own SECURITY.md files. Where conflicts exist, the repository-specific policy takes precedence.
| Component | Supported Versions |
|---|---|
| Streamline Core | Latest 0.x release |
| Client SDKs | Latest 0.x release |
| Kubernetes Operator | Latest 0.x release |
| Terraform Provider | Latest 0.x release |
- TLS 1.2+ encryption for all client connections (TLS 1.3 recommended)
- SASL authentication (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512)
- OAuth 2.0 / OIDC token-based authentication
- Role-based access control (RBAC) with fine-grained ACLs
- AES-256-GCM encryption at rest (optional, feature-gated)
- No secrets in default configuration; credentials loaded from files or environment
- TLS/mTLS support across all SDKs
- SASL/SCRAM authentication support
- No credentials stored in code or logs
- Circuit breakers to prevent cascade failures
- Docker images run as non-root with minimal capabilities
- Helm charts enforce
readOnlyRootFilesystem,runAsNonRoot, and drop all capabilities - Kubernetes NetworkPolicy for traffic isolation
- Secrets managed via environment variables or Kubernetes Secrets
- CodeQL analysis enabled across all repositories
- Dependency scanning via Dependabot
- Signed releases and checksums for binary distributions
We appreciate responsible disclosure and will acknowledge security researchers in release notes (with permission).