Thank you for helping keep iTechie 360 and its projects secure.

The security of our users, customers, contributors, and software is one of our highest priorities. We appreciate the responsible disclosure of security vulnerabilities and are committed to addressing legitimate security issues in a timely manner.

The following table indicates which versions of our software currently receive security updates.

If you are using an unsupported version, please upgrade before reporting security issues whenever possible.

Please DO NOT report security vulnerabilities through public GitHub Issues or Discussions.

Instead, report them privately to the iTechie 360 security team.

Include as much information as possible:

• A description of the vulnerability
• Affected project or repository
• Affected version(s)
• Steps to reproduce
• Proof of concept (if available)
• Potential impact
• Suggested remediation (optional)

Providing detailed information helps us investigate and resolve issues more quickly.

After receiving your report, we will:

• Acknowledge receipt of the report.
• Verify the reported issue.
• Assess the severity and impact.
• Develop and test a fix.
• Coordinate disclosure when appropriate.
• Credit the reporter (if desired).

While response times may vary depending on complexity, our general goals are:

These are goals rather than guarantees.

We ask security researchers to:

• Give us reasonable time to investigate and remediate the issue before public disclosure.
• Avoid accessing, modifying, or deleting user data.
• Avoid service disruption or denial-of-service testing.
• Respect user privacy.
• Report vulnerabilities in good faith.

Responsible disclosure helps protect everyone using our software.

Examples of vulnerabilities that should be reported include:

• Authentication bypass
• Authorization issues
• Remote Code Execution (RCE)
• SQL Injection
• Command Injection
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Server-Side Request Forgery (SSRF)
• Directory Traversal
• Insecure Deserialization
• Privilege Escalation
• Information Disclosure
• Sensitive Data Exposure
• Security Misconfigurations
• API Authentication Issues
• Cryptographic Weaknesses
• Dependency Vulnerabilities

The following are generally considered out of scope unless they present a significant security risk:

• Typographical errors
• Documentation mistakes
• Social engineering attacks
• Missing security headers without exploitability
• Self-XSS
• Clickjacking on non-sensitive pages
• Issues requiring physical access to hardware
• Denial-of-Service testing without prior authorization
• Reports from automated scanners without proof of exploitability

Contributors should:

• Never commit secrets or credentials.
• Use environment variables for sensitive configuration.
• Keep dependencies updated.
• Follow the principle of least privilege.
• Validate all user input.
• Sanitize output where appropriate.
• Use secure authentication mechanisms.
• Encrypt sensitive data in transit and at rest.
• Enable logging and monitoring where applicable.

We encourage contributors to:

• Regularly update dependencies.
• Remove unused packages.
• Review dependency changelogs.
• Address known CVEs promptly.

Dependency security is an essential part of maintaining secure software.

Security patches may be released independently of feature updates.

Critical vulnerabilities may result in immediate releases outside the normal development schedule.

We appreciate the efforts of security researchers and contributors who responsibly disclose vulnerabilities.

With the reporter's permission, significant contributions may be acknowledged in release notes or project documentation.

For security-related matters, please contact the iTechie 360 maintainers through your organization's designated private security communication channel.

Do not disclose vulnerabilities publicly until they have been reviewed and resolved whenever possible.

Thank you for helping keep iTechie 360 secure.