Security Policy #

Supported Versions #

Version	Supported
0.2.x	✅
< 0.2	❌

Reporting a Vulnerability #

Please do not report security vulnerabilities through public GitLab issues.

Instead, please report them via email to: security@codepros.dev

Please include:

1. Description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact assessment
4. Suggested fix (if you have one)

What to Expect #

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 1 week
• Resolution Timeline: Depends on severity
  • Critical: 24-72 hours
  • High: 1-2 weeks
  • Medium: 2-4 weeks
  • Low: Next release cycle

Disclosure Policy #

• We follow responsible disclosure practices
• Security advisories will be published after fixes are available
• Credit will be given to reporters (unless anonymity is requested)

Security Measures #

This project implements:

• Memory Safety: Zig's compile-time memory safety checks
• Memory-safe on tier-1 targets (x86_64/aarch64 Linux): TSan- and fuzz-clean on main; remaining portability caveats for 32-bit/weak-memory targets are tracked in docs/GAP_ANALYSIS.md
• Dependency Scanning: Automated security scanning in CI
• Secret Detection: Gitleaks scanning for leaked credentials

Security Best Practices #

When using this library:

1. Keep dependencies updated
2. Review security advisories regularly
3. Report any suspicious behavior
4. Follow secure coding guidelines

Contact #

For non-security issues, see SUPPORT.md.