The following table lists the supported versions of the Code Analyzer:

We actively maintain the latest release, and patches/backports are applied at our discretion.

To report a vulnerability, please follow these steps:

1. Contact us via [email protected].
2. Include the following details:
   • Clear steps to reproduce the issue.
   • Description of the potential impact on the system.
   • Affected versions or commits.

• DO NOT publish or disclose the vulnerability until we have responded and provided guidance.
• Use encrypted email if necessary for sensitive details.

We adhere to a coordinated disclosure timeline:

• Initial Response: Within 48 hours of the report.
• Resolution Timeline: A fix or mitigation is provided within 7 days.
• Post-Resolution:
  • A security advisory will be published.
  • CHANGELOG.md will be updated with relevant details.

To maintain a secure environment, follow these guidelines:

• Environment Variables:

  • Keep .env files out of public repositories.
  • Use .env.example as a reference and set sensitive values locally.

• Containerization:

  • Use Docker or Docker Compose to isolate the application environment.
  • Regularly update Docker images and dependencies.

• Access Controls:

  • Rotate keys and secrets periodically.
  • Limit access to sensitive resources based on roles.

• Dependency Management:

  • Regularly scan dependencies for vulnerabilities using tools like pip-audit or npm audit.
  • Keep requirements.txt and package.json up to date.

• Code Practices:

  • Avoid hardcoding sensitive information (e.g., API keys, passwords).
  • Use secure coding guidelines to prevent injection attacks, XSS, etc.

We recommend using the following tools to improve security:

• Static Analysis:

  • bandit for Python security linting.
  • ESLint with security plugins for JavaScript.

• Dynamic Analysis:

  • Use tools like OWASP ZAP or Burp Suite for testing web application security.

• Container Security:

  • Use Docker Bench or similar tools to harden container environments.

For any security-related inquiries, contact us at:

• Email: [email protected]
• PGP Key: Available upon request for encrypted communication.

Thank you for helping us maintain the security of Code Analyzer!