We take the security of Study-AI seriously. This document outlines the security policies, supported versions, and vulnerability reporting procedures.

Only the latest release version is supported with security updates.

We strive to maintain high security standards in this project. Please ensure the following:

1. SQL Injection Prevention: All database query operations inside the servlet controllers must utilize PreparedStatement to parameterize inputs. Direct string concatenations inside raw SQL queries are strictly prohibited.
2. Environment Credentials: Never commit plaintext MySQL passwords or URLs to source control. Use the environment variables DB_URL, DB_USER, and DB_PASSWORD to configure production parameters.
3. Cross-Site Scripting (XSS): When rendering database strings inside JSP files, perform escaping or use JSTL <c:out> if possible to prevent raw script execution.

If you discover a security vulnerability within this project, please do not open a public issue. Instead:

1. Draft a detailed report describing the vulnerability, affected components, and steps to reproduce.
2. Email your report to the project maintainers.
3. We will acknowledge your report within 48 hours and work on a patch within 7 days.