We release patches for security vulnerabilities. Currently supported versions:

We take the security of our project seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via one of the following methods:

1. GitHub Security Advisory (Preferred)

   • Go to the repository's Security tab
   • Click "Report a vulnerability"
   • Fill out the form with details

2. Email

   • Send an email to: security@betaversion.io
   • Include "SECURITY" in the subject line

Please include the following information in your report:

• Type of vulnerability
• Full paths of source file(s) related to the vulnerability
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability
• Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Varies based on severity
  • Critical: 1-7 days
  • High: 7-30 days
  • Medium: 30-90 days
  • Low: Best effort

• We will confirm receipt of your vulnerability report
• We will work with you to understand the scope and severity
• We will keep you informed of our progress
• We will notify you when the vulnerability is fixed
• We will publicly disclose the vulnerability after a fix is released
• We will credit you for the discovery (unless you prefer to remain anonymous)

• Never commit sensitive data (API keys, passwords, tokens)
• Use environment variables for configuration
• Keep dependencies up to date
• Follow secure coding practices
• Run security audits: pnpm audit
• Use strong authentication methods
• Implement proper input validation
• Follow the principle of least privilege

• Keep your deployment up to date
• Use strong, unique passwords
• Enable two-factor authentication when available
• Regularly review access logs
• Use HTTPS in production
• Implement proper CORS policies
• Set secure headers (CSP, HSTS, etc.)
• Regular security audits of your deployment

This project implements several security features:

• Docker: Isolated container environment
• Non-root user: Application runs as non-privileged user
• Health checks: Automatic container health monitoring
• Resource limits: Memory and CPU constraints

• HTTPS Only: Enforced in production
• Security Headers:
  • X-Frame-Options
  • X-Content-Type-Options
  • X-XSS-Protection
  • Strict-Transport-Security
  • Content-Security-Policy
  • Referrer-Policy
• Input Validation: All user inputs are validated
• Rate Limiting: API endpoints are rate-limited
• CORS: Properly configured Cross-Origin Resource Sharing

• Automated Updates: Dependabot for dependency updates
• Security Audits: Automated npm audit in CI/CD
• License Compliance: Regular license checks
• Minimal Dependencies: Only necessary packages included

• This is a private repository; access is restricted
• Production deployments should use environment-specific configurations
• Regular security updates are essential
• Monitor security advisories for dependencies

We use the following tools to maintain security:

• Dependabot: Automated dependency updates
• GitHub Security: Vulnerability scanning
• npm audit: Dependency vulnerability checking
• ESLint: Static code analysis with security rules

This project aims to comply with:

• OWASP Top 10 security risks
• CWE (Common Weakness Enumeration)
• Industry standard security practices

If you have questions about security that aren't covered here:

• Check our documentation
• Open a discussion (for non-sensitive topics)
• Contact security@betaversion.io (for sensitive topics)

We appreciate the security research community and all contributors who help make this project more secure.

This security policy may be updated from time to time. Please check back regularly for updates.

Last updated: 2025