# Security policy ## Reporting a vulnerability Please do not open a public issue for a security problem. Report it privately in either of these ways: - **GitHub private vulnerability reporting**: open a draft advisory at . Only the maintainers can see it. - **Email** **sarath.sp06@gmail.com**. Include: - the affected version or commit, - what an attacker needs to start with (no credentials, a consumer-scoped token, a tenant-wide token, the master key), - steps or a reproducer, and the impact you observed. You will get an acknowledgement within 14 days, usually within a few days. Fixes ship in a patch release, and the release notes credit the reporter unless you ask otherwise. ## How a report is handled 1. **Acknowledge** within 14 days and confirm whether the issue reproduces. 2. **Assess** severity using the ratings in the [threat model](THREAT_MODEL.md#severity), and agree a disclosure date with the reporter (normally within 90 days of the report). 3. **Fix** in private, through a GitHub security advisory and its temporary private fork, with a regression test. 4. **Release** a patch version. Its CHANGELOG.md section lists the fix under `### Security`, and the advisory is published with a CVE when one applies. 5. **Credit** the reporter in the advisory and the release notes, unless they ask not to be named. ## Supported versions Only the latest release receives security fixes. Upgrade to it before reporting, if you can. ## Scope The server (`cmd/server`) and the libraries under `pkg/` are in scope. Satellites under `satellites/` (the CLI, recipes, sources and sinks) are helper tools outside the core and are not: report problems in them as ordinary issues. [`THREAT_MODEL.md`](THREAT_MODEL.md) describes the trust boundaries and how findings are rated. Behaviour documented as a known gap in [AGENTS.md](AGENTS.md) (for example, no inbound rate limiting on `/v1`) is not a vulnerability by itself. See [Securing Sparrow](https://sarathsp06.github.io/sparrow/deployment/security/) for deployment guidance.