Skip to content

SECURITY.md

Latest commit

 

History

History
81 lines (53 loc) · 3.99 KB

SECURITY.md

File metadata and controls

81 lines (53 loc) · 3.99 KB
Raw

Security Policy

This policy covers the DevSonic website: the source code in this repository and the live site at https://devsonic.cl.

Supported Versions

devsonic.cl is a website that is deployed continuously, not a library you install. Only the version currently live on https://devsonic.cl, built from the main branch, gets security fixes.

Version Supported
main (live on https://devsonic.cl) ✅
Older commits and past deployments ❌

Reporting a Vulnerability

Please do not report security vulnerabilities through public issues, pull requests, or discussions.

Email sysadmin@devsonic.cl instead, with a subject line starting with [SECURITY]. Please include:

  • A description of the vulnerability and its impact
  • The affected URL, file, or component
  • Steps to reproduce, or a proof of concept
  • Any known mitigations or suggested fixes
  • How you would like to be credited (or say that you'd prefer to stay anonymous)

If you don't get a reply within the timeframe below, please send a follow-up email.

What to Expect

Stage Target timeframe
Acknowledgement of report Within 3 business days
Initial assessment Within 7 days
Status updates At least every 14 days until resolved
Fix deployed: critical/high Within 30 days of confirmation
Fix deployed: medium/low Within 90 days of confirmation

These are targets, not guarantees. Complex issues may take longer, and we will keep you informed if they do.

If we accept the report, we will confirm the issue, work on a fix, deploy it to https://devsonic.cl, and tell you when it is live. If we decline it, for example because it is out of scope or not reproducible, we will explain why.

Coordinated Disclosure

We follow coordinated disclosure. Please give us a chance to fix the issue before you share any details publicly. We ask that you wait until the fix is deployed, or 90 days after your report, whichever comes first. If we need more time, we will ask you for an extension before the deadline passes.

After the fix is live, we are happy to credit you publicly unless you prefer to stay anonymous.

Scope

In scope

  • The source code in this repository
  • The website at https://devsonic.cl
  • Issues such as cross-site scripting (XSS), injection, open redirects, secrets committed to the repository, and vulnerable dependencies with a demonstrated impact on this project

Out of scope

  • Vulnerabilities in third-party dependencies (such as Angular) that have no demonstrated impact on this project. Please report these to the upstream project under its own security policy.
  • Missing security headers or best-practice settings with no demonstrated exploit
  • Clickjacking on pages with no sensitive actions
  • Automated scanner output with no proof of concept
  • Denial of service (DoS/DDoS) or volumetric attacks
  • Social engineering, phishing, or physical attacks
  • Issues that only affect outdated browsers or already-compromised devices

Testing Guidelines

When researching vulnerabilities, please:

  • Do not run denial-of-service attacks or high-volume automated scans against https://devsonic.cl
  • Do not access, change, or delete data that doesn't belong to you
  • Stop testing and report right away if you come across sensitive data
  • Share vulnerability details only with us until the issue is resolved

Safe Harbor

If you make a good-faith effort to follow this policy, we will treat your research as authorized, and we will not take legal action against you over it. If you're unsure whether something is allowed, email us before you test it.

Bug Bounty

This project does not run a paid bug bounty program. We still value your reports, and we will credit researchers who help keep devsonic.cl secure.