wehub-resource-sync
69 lines
2.1 KiB
Markdown
69 lines
2.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 2.x | :white_check_mark: |
|
|
| < 2.0 | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take security seriously at Memvid. If you discover a security vulnerability, please report it responsibly.
|
|
|
|
### How to Report
|
|
|
|
**Please do NOT open a public GitHub issue for security vulnerabilities.**
|
|
|
|
Instead, email us at: **security@memvid.com**
|
|
|
|
Include the following in your report:
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (if any)
|
|
|
|
### What to Expect
|
|
|
|
- **Acknowledgment**: We will acknowledge your report within 48 hours
|
|
- **Assessment**: We will assess the vulnerability and determine its severity
|
|
- **Fix Timeline**: Critical vulnerabilities will be addressed within 7 days
|
|
- **Disclosure**: We will coordinate with you on public disclosure timing
|
|
- **Credit**: We will credit you in our security advisories (unless you prefer anonymity)
|
|
|
|
### Scope
|
|
|
|
The following are in scope:
|
|
- Memory corruption vulnerabilities
|
|
- Data leakage from `.mv2` files
|
|
- Encryption bypass (when using `encryption` feature)
|
|
- Denial of service attacks
|
|
- Path traversal vulnerabilities
|
|
|
|
### Safe Harbor
|
|
|
|
We consider security research conducted in good faith to be authorized. We will not pursue legal action against researchers who:
|
|
- Act in good faith
|
|
- Avoid privacy violations
|
|
- Do not access or modify other users' data
|
|
- Report vulnerabilities promptly
|
|
- Give us reasonable time to fix issues before disclosure
|
|
|
|
## Security Best Practices
|
|
|
|
When using Memvid:
|
|
|
|
1. **File Permissions**: Set appropriate file permissions on `.mv2` files
|
|
2. **Encryption**: Use the `encryption` feature for sensitive data
|
|
3. **Validation**: Validate input before ingesting into memory
|
|
4. **Updates**: Keep Memvid updated to the latest version
|
|
|
|
## Security Features
|
|
|
|
Memvid includes several security features:
|
|
|
|
- **Checksums**: Blake3 checksums for data integrity
|
|
- **Signatures**: Ed25519 signatures for authenticity
|
|
- **Encryption**: Optional AES-256-GCM encryption (`.mv2e` capsules)
|
|
- **Crash Safety**: WAL-based recovery prevents corruption
|