We release patches for security vulnerabilities for the following versions:

We take the security of our project seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via email to: security@BossX429.com

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the following information in your report:

• Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

This information will help us triage your report more quickly.

• Initial Response: Within 48 hours of report submission
• Assessment: Within 5 business days, we will provide an initial assessment
• Remediation Plan: Within 7 days for critical issues, 14 days for high severity
• Fix Release: Depends on complexity, but we aim for:
  • Critical issues: 7-14 days
  • High severity: 14-30 days
  • Medium/Low severity: 30-90 days

We follow a coordinated disclosure process:

1. Private Disclosure: Report the vulnerability privately to our security team
2. Assessment: We assess and validate the vulnerability
3. Fix Development: We develop and test a fix
4. Advance Notice: We notify you before releasing the fix
5. Public Disclosure: After the fix is released, we publicly acknowledge the issue
6. Credit: We credit reporters in our security advisories (if desired)

Please avoid:

• Publicly disclosing the vulnerability before a fix is available
• Exploiting the vulnerability beyond what is necessary to demonstrate it
• Accessing, modifying, or deleting data that doesn't belong to you
• Degrading the service or its users

When a security vulnerability is confirmed:

1. A security advisory will be created in the GitHub Security Advisory Database
2. A fix will be developed in a private repository
3. The fix will be reviewed and tested
4. A new version will be released with the security patch
5. The security advisory will be published
6. Dependabot will notify users of the update

This project implements several security measures:

• CodeQL Analysis: Automated code scanning for security vulnerabilities
• Dependabot: Automatic dependency updates for known vulnerabilities
• Branch Protections: Required reviews and status checks before merging
• Least Privilege: Code runs with minimal necessary permissions
• Input Validation: All external inputs are validated and sanitized
• Secure Defaults: Security features are enabled by default

When using this project:

• Keep your installation up to date with the latest version
• Review and apply security updates promptly
• Follow the principle of least privilege when configuring access
• Monitor system logs for unusual activity
• Report any suspicious behavior

We would like to thank the following individuals for responsibly disclosing security issues:

(No vulnerabilities have been reported yet)

For any questions about this security policy, please contact: security@BossX429.com

This security policy is subject to change. Last updated: November 2025