We take the security of OxUtils seriously. If you discover a security vulnerability, please follow these steps:

Please do not report security vulnerabilities through public GitHub issues.

Send an email to eddycondor07@gmail.com with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-7 days
  • High: 7-14 days
  • Medium: 14-30 days
  • Low: 30-90 days

• We will acknowledge receipt of your report
• We will confirm the vulnerability and determine its impact
• We will release a fix as soon as possible
• We will publicly disclose the vulnerability after a fix is released
• We will credit you in the security advisory (unless you prefer to remain anonymous)

When using OxUtils:

• Always use HTTPS in production
• Store JWT tokens in httpOnly cookies, not localStorage
• Set short expiration times (15 minutes recommended)
• Rotate keys regularly
• Use JWKS for key distribution in microservices

• Use private ACLs for sensitive data
• Enable bucket encryption
• Use presigned URLs for private content
• Implement proper IAM policies
• Enable S3 bucket logging

• Never commit secrets to version control
• Use environment variables for all sensitive data
• Use AWS Secrets Manager or similar for production
• Rotate credentials regularly

• Enable OXI_LOG_ACCESS for compliance
• Set appropriate OXI_RETENTION_DELAY
• Regularly review audit logs
• Export logs to secure storage

OxUtils provides JWT verification but does not handle token storage. Implement secure storage in your application.

Private media URLs are valid for 1 hour by default. Adjust if needed for your use case.

In production, avoid exposing detailed error messages to end users. Use DEBUG=False in Django.

Security updates will be released as patch versions and documented in CHANGELOG.md.

Subscribe to releases on GitHub to be notified of security updates.

For security concerns: eddycondor07@gmail.com

For general issues: GitHub Issues