Security Policy
Supported Versions
We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:
| Version | Supported |
|---|---|
| 1.x.x | ✅ |
| < 1.0 | ❌ |
Reporting a Vulnerability
The Magnet AI team takes security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
Where to Report
Please do not report security vulnerabilities through public GitHub issues.
We use GitHub's private vulnerability reporting feature:
- Go to the repository's "Security" tab
- Click "Report a vulnerability"
- Fill out the form with details
This allows us to discuss the vulnerability privately and collaborate on a fix before disclosing it publicly.
What to Include
To help us better understand the nature and scope of the possible issue, please include as much of the following information as possible:
- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
- Full paths of source file(s) related to the manifestation of the issue
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it
This information will help us triage your report more quickly.
What to Expect
After you submit a report, you can expect:
- Acknowledgment: We will acknowledge receipt of your vulnerability report within 48 hours
- Assessment: We will assess the vulnerability and determine its impact and severity
- Updates: We will keep you informed of the progress towards a fix
- Resolution: We will notify you when the vulnerability is fixed
- Credit: We will credit you in the security advisory (unless you prefer to remain anonymous)
Response Timeline
- Critical vulnerabilities: Patch released within 7 days
- High vulnerabilities: Patch released within 14 days
- Medium vulnerabilities: Patch released within 30 days
- Low vulnerabilities: Patch released within 60 days
Security Update Process
When we receive a security bug report, we will:
- Confirm the problem and determine the affected versions
- Audit code to find any similar problems
- Prepare fixes for all supported versions
- Release new security patch versions as soon as possible
Security Advisories
Security advisories will be published on:
- GitHub Security Advisories
- Repository releases page
- Project website (if applicable)
Automated Security Checks
This project uses automated security scanning:
GitHub Actions
- Dependency Scanning: Checks for known vulnerabilities in dependencies
- Secret Scanning: Detects accidentally committed secrets
Python Security
- pip-audit: Checks Python dependencies for known security vulnerabilities
JavaScript Security
- npm audit: Checks npm dependencies for known vulnerabilities
Security Best Practices
For Contributors
- Never commit secrets: Use environment variables for sensitive data
- Keep dependencies updated: Regularly update to latest secure versions
- Run security checks locally: Use pre-commit hooks before pushing
- Review security alerts: Check GitHub security tab regularly
- Follow secure coding practices: See our contribution guidelines
For Deployments
- Use environment variables: Never hardcode credentials
- Enable HTTPS: Always use SSL/TLS in production
- Regular updates: Keep all dependencies up to date
- Access control: Implement proper authentication and authorization
- Database security: Use strong passwords, enable SSL connections
- Network security: Use firewalls, restrict port access
- Logging and monitoring: Enable security logging and alerts
Vulnerability Disclosure Policy
We believe in coordinated disclosure of security vulnerabilities. We request that:
- You give us reasonable time to fix the vulnerability before public disclosure
- You make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service
- You do not exploit a security issue for purposes other than verification
- You do not access or modify other users' data
- You do not perform any attack that could harm the reliability or integrity of our services
Security Hall of Fame
We would like to thank the following security researchers for responsibly disclosing vulnerabilities:
- [Your Name] - [Vulnerability Type] - [Date]
Compliance
Licenses
All dependencies must be compatible with Apache License 2.0.
Data Protection
- GDPR compliant data handling
- No collection of personal data without consent
- Right to deletion of personal data
Contact
For any security-related questions or concerns, please open a discussion in the repository or use the private vulnerability reporting feature.