Jakob Wennberg
55e8cc1a88
- Replace hardcoded personal email in clear-user-data.sql with placeholder - Change SECURITY.md contact to role-based security@arcim.io - Add supabase/.temp/ and .claude/settings.local.json to .gitignore - Untrack .claude/settings.local.json (keeps file on disk) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1.3 KiB
1.3 KiB
Security Policy
Reporting Vulnerabilities
If you discover a security vulnerability in gnubok, please report it responsibly. Do not open a public issue.
Email: security@arcim.io
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
Scope
The following areas are in scope for security reports:
- Authentication and authorization -- Supabase auth, RLS policies, API route guards
- Accounting data integrity -- journal entry immutability, period lock enforcement, balance validation
- Document retention -- 7-year retention enforcement, deletion prevention
- API routes -- injection, authorization bypass, data leakage
- Extension system -- privilege escalation, sandbox escape
Response Timeline
- Acknowledgment: within 48 hours
- Initial assessment: within 7 days
- Fix for critical issues: within 30 days
- Public disclosure: coordinated with the reporter after the fix is released
Safe Harbor
We will not pursue legal action against security researchers who:
- Act in good faith to avoid harm to users and data
- Report vulnerabilities promptly and do not exploit them beyond what is necessary to demonstrate the issue
- Do not access, modify, or delete other users' data
- Follow the reporting process described above