🔒 Keeping RepoSage secure for everyone

We take the security of RepoSage and our users seriously. This document outlines our supported versions, how to report vulnerabilities, and security best practices for contributors.

We provide security patches for the following versions:

If you discover a security vulnerability, please follow responsible disclosure practices. Do not disclose it publicly or file a GitHub issue.

1. 📧 Email us directly:

   bhoompallykalyanreddy@gmail.com

2. Include the following details:

   • 📝 A clear description of the vulnerability
   • 🔄 Step-by-step instructions to reproduce the issue
   • 🖥️ Environment details (OS, browser, Node.js/Python version)
   • 💥 Potential impact and severity assessment
   • 🔧 Suggested fix or mitigation (if any)
   • 📎 Proof-of-concept (PoC) code or screenshots (if available)

3. Use this subject line format:

   [SECURITY] Brief description of vulnerability
   

RepoSage follows a Coordinated Vulnerability Disclosure process:

1. 🔒 Private Report — Reporter sends details via email (not public issues)
2. ✅ Acknowledgment — We confirm receipt within 24 hours
3. 🔍 Triage — We assess severity using CVSS v3.1 scoring
4. 🔧 Remediation — We develop and test a fix internally
5. 📦 Release — We publish the patched version
6. 📢 Advisory — We publish a security advisory with credit to the reporter
7. 🏅 Recognition — Reporter is credited in the advisory (unless anonymity is requested)

When contributing to RepoSage, please follow these security guidelines:

• Never commit API keys, tokens, passwords, or secrets to the repository
• Use environment variables (.env files) for all sensitive configuration
• Ensure .env files are listed in .gitignore
• Use placeholder values in example/config files (e.g., YOUR_API_KEY_HERE)

• Validate all inputs — Never trust user-supplied data; sanitize and validate
• Avoid SQL injection — Use parameterized queries and ORM methods
• Prevent XSS — Sanitize HTML output in the frontend; avoid dangerouslySetInnerHTML
• Secure dependencies — Run npm audit and pip audit before submitting PRs
• Use HTTPS — All external API calls must use HTTPS endpoints
• Minimize permissions — Request only the GitHub OAuth scopes you need

• Keep dependencies up to date with npm update and pip install --upgrade
• Review new dependencies before adding them — prefer well-maintained packages
• Run npm audit fix to resolve known vulnerabilities in Node.js packages
• Pin dependency versions in production environments

• Never store tokens in localStorage — use httpOnly cookies or secure session storage
• Implement proper rate limiting on all API endpoints
• Use CSRF protection for state-changing requests

• OWASP Top 10 — Most critical web application security risks
• Node.js Security Checklist — Best practices for Node.js
• Python Security Best Practices — Secure Python development
• GitHub Security Advisories — Managing security advisories

We sincerely appreciate the efforts of security researchers and contributors who help keep RepoSage safe. Responsible reporters will be:

• 🏅 Credited in our security advisories
• 📝 Listed in our Hall of Fame (with consent)
• 💌 Thanked by the maintainer team

🔒 Security is everyone's responsibility.
Thank you for helping keep RepoSage safe for the community.

Made with ❤️ by RepoSage & the open-source community