Skip to content

SECURITY.md

Latest commit

 

History

History
78 lines (54 loc) · 2.92 KB

SECURITY.md

File metadata and controls

78 lines (54 loc) · 2.92 KB
Raw

Security Policy

Table of contents

Supported Versions

Version Supported
2.x ✅
1.x ✅ (security fixes only)

Reporting a Vulnerability

We take the security of Password Toggle Bundle seriously. If you believe you have found a security vulnerability, please report it to us as described below.

How to Report

Please do not report security vulnerabilities through public GitHub issues.

Instead, please send an email to: hectorfranco@nowo.tech

Include the following information in your report:

  • Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
  • Full paths of source file(s) related to the issue
  • The location of the affected source code (tag/branch/commit or direct URL)
  • Any special configuration required to reproduce the issue
  • Step-by-step instructions to reproduce the issue
  • Proof-of-concept or exploit code (if possible)
  • Impact of the issue, including how an attacker might exploit it

Response Timeline

  • Initial Response: Within 48 hours
  • Status Update: Within 7 days
  • Resolution: Varies depending on complexity

Disclosure Policy

  • We will confirm receipt of your vulnerability report
  • We will work with you to understand and validate the issue
  • We will develop and release a fix as quickly as possible
  • We will publicly acknowledge your responsible disclosure (if desired)

Preferred Languages

We prefer all communications to be in English or Spanish.

Contact

Release security checklist (12.4.1)

Before tagging a release, confirm:

Item Notes
SECURITY.md This document is current and linked from the README where applicable.
.gitignore and .env .env and local env files are ignored; no committed secrets.
No secrets in repo No API keys, passwords, or tokens in tracked files.
Recipe / Flex Default recipe or installer templates do not ship production secrets.
Input / output Inputs validated; outputs escaped in Twig/templates where user-controlled.
Dependencies composer audit run; issues triaged.
Logging Logs do not print secrets, tokens, or session identifiers unnecessarily.
Cryptography If used: keys from secure config; never hardcoded.
Permissions / exposure Routes and admin features documented; roles configured for production.
Limits / DoS Timeouts, size limits, rate limits where applicable.

Record confirmation in the release PR or tag notes.