88 lines
2.4 KiB
Markdown
88 lines
2.4 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
We release patches for security vulnerabilities in the following versions:
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 1.0.x | :white_check_mark: |
|
|
| < 1.0 | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take the security of 小虾 SaaS seriously. If you believe you have found a security vulnerability, please report it to us as described below.
|
|
|
|
### Please do NOT:
|
|
|
|
- Open a public GitHub issue about the vulnerability
|
|
- Discuss the vulnerability publicly (Twitter, blog posts, etc.)
|
|
|
|
### Please DO:
|
|
|
|
1. **Email us directly:** security@xiaoxia-saas.com
|
|
2. **Include the following information:**
|
|
- Type of vulnerability
|
|
- Full path to the source file(s) related to the vulnerability
|
|
- Location of the affected code (tag/branch/commit)
|
|
- Step-by-step instructions to reproduce the issue
|
|
- Proof-of-concept or exploit code (if possible)
|
|
- Impact of the vulnerability
|
|
|
|
### What to expect:
|
|
|
|
- We will acknowledge your email within 48 hours
|
|
- We will provide a more detailed response within 7 days
|
|
- We will work on a fix and release a patch ASAP
|
|
- We will credit you in the release notes (if you wish)
|
|
|
|
## Security Best Practices
|
|
|
|
When deploying 小虾 SaaS:
|
|
|
|
1. **Change all default secrets:**
|
|
- `JWT_SECRET_KEY` (minimum 32 characters)
|
|
- Database passwords
|
|
- Redis passwords
|
|
|
|
2. **Use HTTPS in production:**
|
|
- Configure SSL certificates
|
|
- Enable HTTPS redirect
|
|
|
|
3. **Enable rate limiting:**
|
|
- Uncomment `RateLimitMiddleware` in production
|
|
- Configure appropriate limits
|
|
|
|
4. **Regular updates:**
|
|
- Keep dependencies up to date
|
|
- Apply security patches promptly
|
|
|
|
5. **Database security:**
|
|
- Use strong passwords
|
|
- Limit network access
|
|
- Enable SSL connections
|
|
|
|
## Security Features
|
|
|
|
小虾 SaaS includes:
|
|
|
|
- ✅ bcrypt password hashing (cost=12)
|
|
- ✅ JWT token signing and validation
|
|
- ✅ SQL injection protection (parameterized queries)
|
|
- ✅ XSS protection (input validation)
|
|
- ✅ CORS configuration
|
|
- ✅ Rate limiting
|
|
- ✅ Session management
|
|
|
|
## Disclosure Policy
|
|
|
|
When we receive a security bug report, we will:
|
|
|
|
1. Confirm the problem and determine affected versions
|
|
2. Audit code to find similar problems
|
|
3. Prepare fixes for all supported versions
|
|
4. Release patches as soon as possible
|
|
5. Publicly disclose the vulnerability
|
|
|
|
Thank you for helping keep 小虾 SaaS and our users safe!
|