Security

Supported versions

Support status may change as the project evolves.

Reporting a vulnerability

Please report vulnerabilities privately, through GitHub's private vulnerability reporting when it is enabled for the repository.

Include as much of the following as you can:

• A description of the vulnerability.
• Steps to reproduce it.
• The potential security impact.
• A minimal proof of concept.
• Any suggested fix.

Please leave out real credentials, personal data and production information.

What happens next

The maintainer reviews the report, assesses its severity and decides on a fix. The aim is to acknowledge a report within 7 days. That is a goal, not a guarantee. Once a fix is ready, disclosure is coordinated with you.

Scope

This policy covers vulnerabilities in RiserBob itself, including its request handling, routing, middleware and the other maintained components. Vulnerabilities in third-party dependencies may need to be reported to their own maintainers.

Keeping your app safe

• Keep your dependencies updated.
• Validate every untrusted input with the Validator, and pick the fields you save instead of passing the whole body to your database.
• Do not expose internal error details to clients. RiserBob already hides the details of unexpected errors, so keep your own messages free of them too.
• Never commit secrets, API keys or credentials. Keep them in .env, and rotate any key that was exposed.
• Apply authentication and authorization where required, and filter data by its owner. See JWT and cookies.
• Review your middleware and route configuration carefully, especially the order of spongUse calls.