SECURITY.md

Security

Supported Scope

This project is early-stage unless stated otherwise. Security expectations still apply to local development, tests, documentation, and deployment scripts.

Secret Handling

• Do not commit .env files containing real values.
• Use .env.example to document required variables.
• Never commit tokens, private keys, passwords, session cookies, or production credentials.
• Redact secrets from logs, screenshots, issues, and documentation.

Security-Sensitive Areas

Treat these changes as requiring extra review:

• Authentication and authorization.
• Database queries and migrations.
• File upload, parsing, or path handling.
• Shell command execution.
• External webhooks or callbacks.
• Dependency additions or upgrades.
• CI/CD, deployment, and infrastructure configuration.

Dependency Standard

Before adding a dependency, consider:

• Is it necessary?
• Is it actively maintained?
• Is the license acceptable?
• Does it meaningfully increase attack surface?

Reporting Issues

For private projects, report security issues directly to the repository owner. For public projects, replace this section with a private contact method or GitHub Security Advisory instructions.

Pre-Release Checklist

• No secrets are committed.
• Environment variables are documented in .env.example.
• Relevant tests pass.
• Authentication and authorization flows have been reviewed.
• Logs avoid sensitive data.
• Dependencies are reviewed for obvious risk.