| Parameter | Policy Details |
|---|---|
| Responsible Disclosure | Coordinated vulnerability disclosure |
| Response SLA | Initial acknowledgment within 24 hours |
| Resolution Target | Critical vulnerabilities patched within 7 business days |
Security updates and patches are actively maintained for the following versions:
| Version | Supported | Notes |
|---|---|---|
1.x.x |
Yes | Current production release line |
< 1.0 |
No | Deprecated pre-release versions |
If you discover a security vulnerability in Rentify Backend, please do NOT report it via public GitHub issues.
Instead, report it privately through one of the following channels:
- GitHub Security Advisory: Use the Private Vulnerability Reporting feature on GitHub.
- Email: Send encrypted details to
security@rentify.dev(or the maintainer's contact email).
- A descriptive summary of the vulnerability (e.g. IDOR, Authentication Bypass, Injection, Concurrency Race Condition).
- Step-by-step reproduction instructions or a minimal Proof of Concept (PoC).
- Potential impact on users, wallets, or confidential data.
- Any suggested fixes or remediations.
- Acknowledgment: Within 24 hours of report receipt.
- Triage & Reproduction: Within 48 hours to confirm severity and assess impact using CVSS v3.1.
- Patch Development & Testing: Tested hermetically against Testcontainers and dedicated test suites.
- Public Advisory: Published concurrently with the patch release, giving credit to the reporter (unless anonymity is requested).