We provide security updates for the following versions:

We take security vulnerabilities seriously. If you discover a security vulnerability, please follow these steps:

Security vulnerabilities should be reported privately to protect our users.

Send an email to: ibrahim1995412@gmail.com

Include the following information:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)
• Your contact information

• Initial Response: Within 24 hours
• Status Update: Within 72 hours
• Resolution: Depends on severity and complexity

• JWT token-based authentication
• OTP (One-Time Password) verification
• Role-based access control (RBAC)
• Multi-factor authentication support

• Encryption at rest and in transit
• Secure password hashing (bcrypt)
• Input validation and sanitization
• SQL injection prevention

• HTTPS enforcement
• CORS configuration
• Rate limiting
• Request validation

• Regular security updates
• Container security scanning
• Dependency vulnerability scanning
• Secure configuration management

We use automated security scanning tools:

• Dependency Scanning: GitHub Dependabot
• Container Scanning: Trivy
• Code Analysis: SonarQube
• SAST: CodeQL

Before deploying to production:

• All dependencies are up to date
• Security tests pass
• No hardcoded secrets
• Input validation implemented
• Error handling secure
• Logging configured properly
• Monitoring in place

The following are considered out of scope for our security program:

• Social engineering attacks
• Physical attacks
• Attacks requiring physical access to the server
• Attacks on third-party services we don't control

We maintain a security acknowledgments page for researchers who responsibly disclose vulnerabilities.

For security-related questions or concerns:

• Email: ibrahim1995412@gmail.com
• Response Time: 24-48 hours
• PGP Key: Available upon request

Last Updated: January 2025 Next Review: July 2025