# Security Policy

## Supported Versions

We release patches for security vulnerabilities for the following versions:

| Version | Supported          |
| ------- | ------------------ |
| latest  | :white_check_mark: |
| < 1.0   | :x:                |

## Reporting a Vulnerability

If you discover a security vulnerability, please report it by:

1. **DO NOT** open a public issue
2. Email the maintainers or use GitHub's private vulnerability reporting
3. Include detailed information about the vulnerability:
   - Type of vulnerability
   - Steps to reproduce
   - Potential impact
   - Suggested fix (if any)

We will respond within 48 hours and provide regular updates on the fix progress.

## Security Measures

### Build Pipeline Security

Our CI/CD pipeline implements multiple security layers:

1. **Fork PR Protection**: Pull requests from forks require manual approval (via `safe-to-build` label) before builds run
2. **SBOM Generation**: Software Bill of Materials is generated for all builds
3. **Provenance Attestation**: Build provenance is recorded for supply chain security
4. **Limited Permissions**: Workflows use minimal required permissions
5. **No Push from PRs**: Pull requests only build images locally, never push to registry

### Container Security

- Verified amd64 image builds
- Regular base image updates
- Minimal attack surface
- Non-root user execution where possible

### Dependency Management

- Automated dependency updates via Dependabot
- Security alerts enabled
- Regular security audits

## Security Best Practices for Contributors

When contributing:

1. Never commit secrets, tokens, or credentials
2. Use environment variables for sensitive configuration
3. Keep dependencies up to date
4. Follow principle of least privilege
5. Validate and sanitize all user inputs
6. Use parameterized queries for database operations

## Automated Security Checks

Our repository includes:

- **Dependabot** for dependency updates
- **GitHub Security Advisories** monitoring

## Safe-to-Build Label

For maintainers reviewing fork PRs:

1. Review the PR code thoroughly for malicious content
2. Check for suspicious file modifications
3. Verify no secrets or credentials are exposed
4. Only add `safe-to-build` label if code is verified safe
5. Remove label immediately if concerns arise

## Security Updates

Security updates are prioritized and released as soon as possible. Subscribe to repository releases to stay informed.
