The UNI.Framework team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings.

To report a security issue, please use GitHub Security Advisory.

After you have submitted a vulnerability report, you can expect the following response process:

1. Acknowledgment: We will acknowledge receipt of your vulnerability report ASAP.
2. Verification: Our security team will work to verify the vulnerability and determine its impact.
3. Remediation Planning: We will develop a plan to address the vulnerability and communicate our plans with you.
4. Fix Implementation: We will implement the fix and test it thoroughly.
5. Public Disclosure: Once the vulnerability has been fixed, we will coordinate with you on the disclosure timeline.

When using UNI.Framework, we recommend following these best practices:

• Keep your UNI.Framework installation up to date with the latest security patches
• Review your application's authentication and authorization mechanisms regularly
• Follow the principle of least privilege for API access and data management
• Implement proper input validation and output encoding to prevent injection attacks
• Use HTTPS for all communications
• Regularly audit your application's security posture

Currently, we do not have a formal bug bounty program. However, we appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities in our acknowledgments.

Please note that this security policy is governed by our Code of Conduct. We expect all interactions regarding security disclosures to adhere to this code.

This security policy may be updated from time to time. Please check back periodically for any changes.

Last updated: April 22, 2025