Skip to content

Repository navigation

Security: ItsWanheda/expense-tracker

Security

Report a vulnerability

SECURITY.md

Security Policy 🛡

🔍 Commitment to Security

Maintaining the security an integrity of the Expense-Tracker project is a top priority. We take all security-related reports seriously and are committed to addressing vulnerabilities promptly and responsibly.

Supported Versions

Version Supported
0.5.x ✅
0.4.x ✅
0.2.x ❌
0.1.x ❌

Support policy: Versions 0.1.x, 0.2.x, and 0.3.x are no longer supported. Versions 0.4.x and 0.5.x are supported, with 0.5.x representing the current development line. Users are encouraged to upgrade to the latest available version.

🚨 Reporting a Vulnerability

DO NOT open a public issue for security vulnerabilities.

Opening a public issue for a vulnerability can expose users to risks before a patch is available. Instead, please follow the private disclosure process below:

How to Report

If you discover a potential security flaw, please report it privately by:

  1. Emailing: [wanheda.work@gmail.com]
  2. Subject Line: Use [SECURITY VULNERABILITY] Expense-Tracker to ensure priority handling.

What to Include in Your Report

To help us understand and fix the issue as quickly as possible, please include:

  • Description: A detailed explanation of the vulnerability.
  • Impact: What could an attacker achieve (e.g., unauthorized data access, remote code execution)?
  • Steps to Reproduce: A Proof of Concept (PoC) or clear steps to trigger the vulnerability.
  • Environment Details: Python version, OS, and any specific configurations used.
  • Suggested Mitigation: (Optional) If you have a idea for a fix, we’d love to hear it!

🛠 Our Response Process

Once a report is received, the maintainer will:

  1. Acknowledge Receipt: Confirm that we have received your report (usually within 48-72 hours).
  2. Investigation: Verify the vulnerability and assess its severity.
  3. Remediation: Develop a fix/patch for the issue.
  4. Disclosure: Once a patch is released, we will notify you and potentially release a public advisory.

🎯 Scope

This policy applies to the source code, documentation, and any hosted components of the Expense-Tracker repository.

📜 Disclaimer

While we strive to maintain a secure environment, no software is 100% secure. By reporting a vulnerability, you agree to act in good faith and not to exploit the vulnerability or use it to harm any users or systems.

Thank you for helping us keep Expense-Tracker safe! 🦾🛡️

There aren't any published security advisories