Jakob Wennberg
55e8cc1a88
- Replace hardcoded personal email in clear-user-data.sql with placeholder - Change SECURITY.md contact to role-based security@arcim.io - Add supabase/.temp/ and .claude/settings.local.json to .gitignore - Untrack .claude/settings.local.json (keeps file on disk) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting Vulnerabilities
|
|
|
|
If you discover a security vulnerability in gnubok, please report it responsibly. **Do not open a public issue.**
|
|
|
|
Email: **security@arcim.io**
|
|
|
|
Include:
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (if any)
|
|
|
|
## Scope
|
|
|
|
The following areas are in scope for security reports:
|
|
|
|
- **Authentication and authorization** -- Supabase auth, RLS policies, API route guards
|
|
- **Accounting data integrity** -- journal entry immutability, period lock enforcement, balance validation
|
|
- **Document retention** -- 7-year retention enforcement, deletion prevention
|
|
- **API routes** -- injection, authorization bypass, data leakage
|
|
- **Extension system** -- privilege escalation, sandbox escape
|
|
|
|
## Response Timeline
|
|
|
|
- **Acknowledgment**: within 48 hours
|
|
- **Initial assessment**: within 7 days
|
|
- **Fix for critical issues**: within 30 days
|
|
- **Public disclosure**: coordinated with the reporter after the fix is released
|
|
|
|
## Safe Harbor
|
|
|
|
We will not pursue legal action against security researchers who:
|
|
|
|
- Act in good faith to avoid harm to users and data
|
|
- Report vulnerabilities promptly and do not exploit them beyond what is necessary to demonstrate the issue
|
|
- Do not access, modify, or delete other users' data
|
|
- Follow the reporting process described above
|