At Flowboard, we take security seriously. This policy outlines how to report security vulnerabilities and how we handle them.

If you discover a security vulnerability, please report it privately and responsibly:

1. Create a private issue on GitLab:

   • Go to GitLab Issues
   • Mark the issue as "Confidential"
   • Use the title "Security: [Brief Description]"
   • Provide detailed information about the vulnerability

2. What to Include:

   • Detailed description of the vulnerability
   • Steps to reproduce the issue
   • Potential impact assessment
   • Any proof-of-concept code or screenshots
   • Your suggested fix (if any)

• Publicly disclose the vulnerability
• Create a public issue or merge request
• Discuss the vulnerability in public channels
• Attempt to exploit the vulnerability beyond testing

• Initial Response: Within 48 hours
• Assessment: Within 1 week
• Fix Development: As needed based on severity
• Public Disclosure: After fix is deployed

• Critical: Immediate risk to users/data
• High: Significant impact on security
• Medium: Limited impact or requires specific conditions
• Low: Minimal security impact

1. Acknowledge: We'll confirm receipt of your report
2. Assess: We'll evaluate the vulnerability and its impact
3. Develop: We'll create a fix and test it thoroughly
4. Deploy: We'll release the fix in a security update
5. Disclose: We'll publicly acknowledge the vulnerability (with your permission)

Security researchers who responsibly disclose vulnerabilities will be:

• Acknowledged in our security advisories
• Listed in our security hall of fame (with permission)
• Eligible for security bounties (if program is active)

• Keep your application updated
• Use strong, unique passwords
• Enable two-factor authentication when available
• Be cautious with board sharing permissions

• Follow secure coding practices
• Validate all user inputs
• Use HTTPS for all communications
• Keep dependencies updated
• Review code for security issues

• All data is stored locally in the browser
• No data is sent to external servers without explicit action
• Export/import functions handle data locally
• Board sharing uses secure, temporary links

• Input validation and sanitization
• Secure file handling for import/export
• XSS protection through React's built-in safeguards
• Secure default configurations
• Regular dependency updates

• Content Security Policy (CSP)
• Additional input validation layers
• Security headers implementation
• Automated security scanning

We use various tools to maintain security:

• Dependency Scanning: Regular checks for vulnerable packages
• Code Analysis: Static analysis for security issues
• Manual Review: Regular security code reviews
• Penetration Testing: Periodic security assessments

For security-related matters:

• Security Issues: Create a confidential GitLab issue
• General Security Questions: Create a regular GitLab issue with "Security Question" label
• Emergencies: Contact through GitLab's private issue system

This security policy may be updated periodically. Major changes will be:

• Announced in release notes
• Posted on GitLab discussions
• Highlighted in the repository

We appreciate security researchers and ethical hackers who help us improve our security. We commit to:

• Responding promptly to security reports
• Working transparently with researchers
• Providing credit for valid discoveries
• Learning from each incident to improve our security

Thank you for helping keep Flowboard secure! 🛡️