We actively support the following versions with security updates:

The security of our users is extremely important to us. If you discover a security vulnerability, please follow these steps:

Instead, please report security issues privately using one of these methods:

1. Go to the Security Advisories page
2. Click "Report a vulnerability"
3. Fill out the form with detailed information

Send an email to [INSERT_SECURITY_EMAIL_HERE] with:

• Subject: "Security Vulnerability Report - Chat Application"
• Detailed description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact assessment
• Any suggested fixes or mitigations

Please provide as much information as possible:

• Description: Clear description of the vulnerability
• Impact: What could an attacker accomplish?
• Reproduction: Step-by-step instructions to reproduce
• Environment: Browser, OS, Node.js version, etc.
• Screenshots: If applicable
• Suggested Fix: If you have ideas for remediation

• Initial Response: Within 24-48 hours
• Status Update: Within 7 days
• Resolution: We aim to resolve critical issues within 30 days

Our application includes comprehensive security measures:

• NextAuth.js with secure session management
• Bcrypt password hashing with salt rounds
• Environment-based user configuration
• JWT token-based authentication

• IP-based rate limiting (5 requests per 10 seconds)
• In-memory rate limiting with sliding window
• Automatic request throttling

• HSTS (Strict-Transport-Security)
• CSP (Content-Security-Policy)
• X-Frame-Options (Clickjacking protection)
• X-Content-Type-Options (MIME sniffing protection)
• X-XSS-Protection
• Referrer-Policy
• Permissions-Policy

• Zod schema validation for all inputs
• Image format and size validation
• Message content length limits
• Runtime type checking

• Origin validation for state-changing requests
• Same-origin policy enforcement
• Secure cookie configuration

• HTTPS enforcement in production
• Environment variable validation
• Secure Docker configuration
• Google Cloud Run deployment with IAM

This security policy covers:

• ✅ The main chat application
• ✅ API endpoints and authentication
• ✅ Client-side security issues
• ✅ Infrastructure misconfigurations
• ✅ Dependency vulnerabilities

This policy does NOT cover:

• ❌ Issues in third-party services (Google Vertex AI, etc.)
• ❌ Social engineering attacks
• ❌ Physical security
• ❌ Issues requiring physical access to servers

• We follow responsible disclosure practices
• We will acknowledge your contribution in our security acknowledgments
• We request that you do not publicly disclose the vulnerability until we have had a chance to address it
• We commit to keeping you informed throughout the remediation process

We would like to thank the following individuals for responsibly disclosing security vulnerabilities:

No vulnerabilities have been reported yet.

For security-related questions that are not vulnerabilities, you can:

• Open a regular GitHub issue with the "security" label
• Start a discussion in GitHub Discussions

Last Updated: January 2025 Next Review: Quarterly