Skip to content

Security: Nebutra/Sailor-Template

Security

SECURITY.md

Security Policy

Supported Versions

We release patches for security vulnerabilities in the following versions:

Version Supported
latest ✅
< 1 month old ✅
older ❌

Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

Email security@nebutra.com with:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce (proof of concept if available)
  • Affected versions and components
  • Suggested fix or mitigation (if any)

We will acknowledge your report within 48 hours and aim to:

  • Confirm the vulnerability within 5 business days
  • Release a patch within 14 days for Critical/High severity
  • Release a patch within 30 days for Medium severity
  • Credit you in the release notes (unless you prefer to remain anonymous)

Severity Classification

We follow CVSS v3.1 for severity scoring:

Severity CVSS Score Patch target
Critical 9.0–10.0 14 days
High 7.0–8.9 14 days
Medium 4.0–6.9 30 days
Low 0.1–3.9 Next release

Commitment level by tier

The targets above are what we aim for and have met to date. Whether they are a best-effort target or a contractual obligation depends on your tier — we would rather state this plainly than let a published table read as a guarantee it is not.

Community (free) Team Enterprise
Acknowledgement of report 48h target 48h target 4 business hours, contractual
Patch timelines above Best-effort target Best-effort target Contractual, with remedies
Production-down escalation ✗ ✗ 1 hour
Advance notice of security releases ✗ ✅ ✅
Backports to a pinned major version ✗ ✗ ✅ long-term support branch
Named security contact ✗ ✗ ✅

No commitment level changes how we handle a report from a security researcher — disclosure is triaged on severity, never on who is paying. The tiers govern what we owe deployers, not what we do for reporters.

See LICENSE-COMMERCIAL.md and Security & Compliance.

Security Measures

This project implements the following security controls:

  • Dependency auditing: Automated pnpm audit in CI, Dependabot for dependency updates
  • Secret scanning: GitHub Advanced Security secret scanning enabled
  • SAST: CodeQL static analysis on every push and PR
  • Container scanning: Trivy vulnerability scanning on all Docker images
  • Supply chain: SLSA Build Level 2 provenance attestations for releases
  • Rate limiting: Application-level rate limiting on all public API endpoints
  • Authentication: Clerk-managed authentication with MFA support
  • Secure headers: X-Frame-Options, HSTS, X-Content-Type-Options on all responses

Scope

The following are in scope for vulnerability reports:

  • apps/web — authenticated dashboard
  • apps/landing — public marketing site
  • backends/gateway — Hono API gateway
  • backends/python/* — Python microservices (active tier only — see ADR 2026-05-10)
  • packages/* — shared libraries

The following are out of scope:

  • Third-party services (Clerk, Resend, Stripe, etc.) — report to their respective security teams
  • Issues requiring physical access to infrastructure
  • Social engineering attacks

PGP Key

For encrypted communication, use our PGP key:

Fingerprint: (contact security@nebutra.com to request)

Bug Bounty

We do not currently operate a paid bug bounty program, but we deeply appreciate responsible disclosure and will credit security researchers in our release notes.

This policy is based on the GitHub Security Policy template.

There aren't any published security advisories