diff --git a/Security.md b/Security.md new file mode 100644 index 0000000..c395120 --- /dev/null +++ b/Security.md @@ -0,0 +1,61 @@ +## Security Policy + +## Supported Versions + +The following versions of Edulume are currently supported with security updates: + +| Version | Supported | +|---------|-----------| +| 1.x.x | Yes | +| 0.x.x | No | + +## Reporting a Vulnerability + +If you discover a security vulnerability in Edulume, we encourage you to report it as soon as possible. We will investigate all legitimate reports and do our best to quickly fix the issue. + +## How to Report + +Please report vulnerabilities by emailing us at tarinagarwal@gmail.com. Include as much detail as possible to help us identify and fix the issue swiftly. + +Do not share the vulnerability publicly until it has been addressed and a patch is available. + +## Security Updates + +We will notify users via GitHub releases for any critical security updates. +Minor security patches will be included in regular updates as needed. + +## Response Timeline + +We aim to follow this response process: + +- Initial acknowledgment: within 48 hours +- Investigation and assessment: within 5–7 business days +- Fix and patch release: as soon as reasonably possible, depending on severity + +## Scope of Security Concerns + +The following areas are considered in scope for security reports: + +- Authentication and authorization mechanisms +- API endpoints and backend services +- User data handling and storage +- File uploads and document storage +- Access control and permission issues +- Dependency-related vulnerabilities + +The following are out of scope: + +- Social engineering attacks +- Physical attacks +- Denial-of-service attacks without proof of concept + +## Security Best Practices + +- Make sure to use the latest version of Edulume for the latest security features and patches. +- Follow password best practices, such as using strong, unique passwords for each account. +- Regularly update your dependencies to the latest versions. + +## Acknowledgements + +We appreciate contributions from the community and researchers who help us improve the security of Edulume. Thank you for keeping the platform secure for everyone! +