If you discover a security vulnerability in barrel_docdb, please report it responsibly.

DO NOT open a public issue for security vulnerabilities.

1. Email: Send details to security@barrel-db.eu
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Any suggested fixes (optional)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 5 business days
• Resolution Timeline: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: 90 days

This policy applies to:

• barrel_docdb core library
• HTTP API endpoints
• Replication protocols
• Storage layer

• Issues in dependencies (report to upstream)
• Self-hosted deployment misconfigurations
• Social engineering attacks

When deploying barrel_docdb:

1. Network Security: Use TLS for HTTP endpoints
2. Authentication: Enable authentication for production
3. Access Control: Restrict database access appropriately
4. Updates: Keep dependencies updated
5. Monitoring: Enable metrics and alerting

We appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities (unless they prefer to remain anonymous).