Instead, please report security issues through one of these secure channels:

1. Go to the Nucleus State repository
2. Click on the "Security" tab
3. Click "Report a vulnerability"
4. Fill out the form with details

Send an email to: sinhaparth555@gmail.com

Include the following information:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact of the vulnerability
• Suggested fix (if you have one)
• Your contact information for follow-up

Please provide as much information as possible:

## Vulnerability Report

**Summary**: Brief description of the vulnerability

**Severity**: Low / Medium / High / Critical

**Component**: Which part of the library is affected

**Description**: 
Detailed description of the vulnerability and how it could be exploited.

**Reproduction Steps**:
1. Step 1
2. Step 2
3. Step 3

**Impact**: 
What could an attacker accomplish by exploiting this vulnerability?

**Affected Versions**: 
Which versions of Nucleus State are affected?

**Suggested Fix**: 
If you have ideas for how to fix the issue, please share them.

**Additional Context**: 
Any other relevant information.

## XSS Vulnerability in Atom Persistence

**Severity**: High

**Component**: Persistence mechanism

**Description**: 
The persistence feature does not properly sanitize data when reading from localStorage, 
potentially allowing stored XSS attacks if malicious data is injected into localStorage 
by another script.

**Reproduction Steps**:
1. Create a persisted atom
2. Manually inject malicious script into localStorage key
3. Refresh page - malicious script executes

**Impact**: 
Could allow XSS attacks if localStorage is compromised by other scripts.

**Suggested Fix**: 
Add data validation and sanitization when reading from storage.

When you report a security vulnerability, we commit to:

1. Acknowledge receipt within 48 hours
2. Provide initial assessment within 1 week
3. Keep you informed of progress throughout the process
4. Credit you in the security advisory (if desired)

We classify security vulnerabilities using the following criteria:

• Remote code execution
• Authentication bypass
• Data exfiltration at scale

• Cross-site scripting (XSS)
• Privilege escalation
• Significant data exposure

• Information disclosure
• Denial of service
• CSRF vulnerabilities

• Minor information leaks
• Edge case vulnerabilities
• Theoretical attacks

When using Nucleus State in your applications:

const createSecureAtom = (initialValue, key) => {
  return createAtom(initialValue, {
    persist: key,
    validator: (data) => {
      // Add your validation logic
      return isValidData(data);
    }
  });
};

import DOMPurify from 'dompurify';

const userInputAtom = createAtom('');

// Sanitize before storing
const setUserInput = (input) => {
  const sanitized = DOMPurify.sanitize(input);
  setAtomValue(userInputAtom, sanitized);
};

<meta http-equiv="Content-Security-Policy" 
      content="default-src 'self'; script-src 'self'">

• Keep Nucleus State updated to the latest version
• Monitor our security advisories
• Review your dependencies regularly

When contributing to Nucleus State:

• Consider security implications of new features
• Review code for potential vulnerabilities
• Add security tests where appropriate

• Keep dependencies up to date
• Audit new dependencies for security issues
• Use npm audit regularly

• Validate all inputs
• Sanitize outputs
• Follow principle of least privilege

Before using Nucleus State in production:

• Updated to latest version
• No sensitive data in atoms
• Persisted data is validated
• User inputs are sanitized
• CSP headers are configured
• Regular security audits scheduled
• Dependencies are up to date
• Error handling doesn't expose sensitive info

• localStorage/sessionStorage can be accessed by any script on the page
• Data persists across browser sessions
• No encryption by default

• Only persist non-sensitive data
• Implement custom encryption if needed
• Use short expiration times for sensitive data
• Validate data integrity

• Email: sinhaparth555@gmail.com
• GPG Key: [Available on request]

• GitHub: @sinhaparth5
• Email: sinhaparth555@gmail.com

We appreciate security researchers who help make Nucleus State more secure:

No security vulnerabilities have been reported yet.

• OWASP JavaScript Security Guide
• MDN Web Security
• React Security Best Practices

• npm audit
• Snyk
• OWASP ZAP

Last Updated: December 2024
Version: 1.0

For any questions about this security policy, please contact: sinhaparth555@gmail.com