From 5d3404ecaeb85b2881f36a616a5bd9fe9c872417 Mon Sep 17 00:00:00 2001 From: drkjc Date: Wed, 14 Oct 2026 15:49:46 -0400 Subject: [PATCH 1/3] docs: add security policy --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..22792fe --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy + +## Reporting Security Vulnerabilities + +Spreedly takes security seriously and appreciates your help in keeping our products and services secure. If you discover a security vulnerability in this repository, please report it to us using one of the following methods. **Do not** open a public GitHub issue, pull request, or discussion describing the vulnerability. + +### Option 1: Spreedly Help Center + +Submit a security vulnerability report through the [Spreedly Help Center](https://spreedly.com/support/) by submitting a request to Customer Support. This will open a support ticket for you, allowing you to securely communicate with our security team. + +### Option 2: Spreedly Security Team + +Email our security team directly at **security@spreedly.com** with details about the vulnerability you've discovered. + +## What to Include in Your Report + +When reporting a security vulnerability, please include: + +- A clear description of the vulnerability +- Steps to reproduce the issue +- Potential impact of the vulnerability +- Any suggested fixes or mitigations (if available) + +## Response Timeline + +We will acknowledge receipt of your report within 48 hours and provide an initial assessment within 5 business days. We'll keep you informed of our progress as we work to address the issue. + +## Disclosure Policy + +We ask that you: + +- Allow us a reasonable amount of time to address the vulnerability before public disclosure +- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services +- Not access or modify data that does not belong to you + +Thank you for helping keep Spreedly and our customers secure. From e9d3b11c86789d2bc2a03f72390cf708e395d131 Mon Sep 17 00:00:00 2001 From: drkjc Date: Wed, 14 Oct 2026 15:49:46 -0400 Subject: [PATCH 2/3] docs: list runtime dependencies and licenses in NOTICE --- NOTICE | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NOTICE b/NOTICE index 18f97a0..4e52713 100644 --- a/NOTICE +++ b/NOTICE @@ -1,2 +1,13 @@ Spreedly Composer Ruby Server SDK Copyright 2025-2026 Spreedly, Inc. + +This SDK depends on the following gems at runtime. They are installed from +RubyGems alongside the SDK; they are not bundled with it. Full license texts +are in THIRD-PARTY-LICENSES. + +- faraday (MIT) +- faraday-net_http (MIT) +- net-http (Ruby / BSD-2-Clause) +- uri (Ruby / BSD-2-Clause) +- json (Ruby) +- logger (Ruby / BSD-2-Clause) From 14d187003547228fb0e27fea54db3f87088fd330 Mon Sep 17 00:00:00 2001 From: drkjc Date: Wed, 14 Oct 2026 17:01:39 -0400 Subject: [PATCH 3/3] docs: add net-protocol and timeout to runtime dependency licenses --- NOTICE | 2 + THIRD-PARTY-LICENSES | 174 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 176 insertions(+) diff --git a/NOTICE b/NOTICE index 4e52713..5880d5f 100644 --- a/NOTICE +++ b/NOTICE @@ -8,6 +8,8 @@ are in THIRD-PARTY-LICENSES. - faraday (MIT) - faraday-net_http (MIT) - net-http (Ruby / BSD-2-Clause) +- net-protocol (Ruby / BSD-2-Clause) +- timeout (Ruby / BSD-2-Clause) - uri (Ruby / BSD-2-Clause) - json (Ruby) - logger (Ruby / BSD-2-Clause) diff --git a/THIRD-PARTY-LICENSES b/THIRD-PARTY-LICENSES index 622bfad..fae53fc 100644 --- a/THIRD-PARTY-LICENSES +++ b/THIRD-PARTY-LICENSES @@ -89,6 +89,180 @@ Ruby is copyrighted free software by Yukihiro Matsumoto . You can redistribute it and/or modify it under either the terms of the 2-clause BSDL (see the file BSDL), or the conditions below: +1. You may make and give away verbatim copies of the source form of the + software without restriction, provided that you duplicate all of the + original copyright notices and associated disclaimers. + +2. You may modify your copy of the software in any way, provided that + you do at least ONE of the following: + + a. place your modifications in the Public Domain or otherwise + make them Freely Available, such as by posting said + modifications to Usenet or an equivalent medium, or by allowing + the author to include your modifications in the software. + + b. use the modified software only within your corporation or + organization. + + c. give non-standard binaries non-standard names, with + instructions on where to get the original software distribution. + + d. make other distribution arrangements with the author. + +3. You may distribute the software in object code or binary form, + provided that you do at least ONE of the following: + + a. distribute the binaries and library files of the software, + together with instructions (in the manual page or equivalent) + on where to get the original distribution. + + b. accompany the distribution with the machine-readable source of + the software. + + c. give non-standard binaries non-standard names, with + instructions on where to get the original software distribution. + + d. make other distribution arrangements with the author. + +4. You may modify and include the part of the software into any other + software (possibly commercial). But some files in the distribution + are not written by the author, so that they are not under these terms. + + For the list of those files and their copying conditions, see the + file LEGAL. + +5. The scripts and library files supplied as input to or produced as + output from the software do not automatically fall under the + copyright of the software, but belong to whomever generated them, + and may be sold commercially, and may be aggregated with this + software. + +6. THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + PURPOSE. + +============================================================================== +net-protocol (Ruby / BSD-2-Clause) +https://github.com/ruby/net-protocol +============================================================================== + +--- BSDL --- +Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +SUCH DAMAGE. + +--- COPYING --- +Ruby is copyrighted free software by Yukihiro Matsumoto . +You can redistribute it and/or modify it under either the terms of the +2-clause BSDL (see the file BSDL), or the conditions below: + +1. You may make and give away verbatim copies of the source form of the + software without restriction, provided that you duplicate all of the + original copyright notices and associated disclaimers. + +2. You may modify your copy of the software in any way, provided that + you do at least ONE of the following: + + a. place your modifications in the Public Domain or otherwise + make them Freely Available, such as by posting said + modifications to Usenet or an equivalent medium, or by allowing + the author to include your modifications in the software. + + b. use the modified software only within your corporation or + organization. + + c. give non-standard binaries non-standard names, with + instructions on where to get the original software distribution. + + d. make other distribution arrangements with the author. + +3. You may distribute the software in object code or binary form, + provided that you do at least ONE of the following: + + a. distribute the binaries and library files of the software, + together with instructions (in the manual page or equivalent) + on where to get the original distribution. + + b. accompany the distribution with the machine-readable source of + the software. + + c. give non-standard binaries non-standard names, with + instructions on where to get the original software distribution. + + d. make other distribution arrangements with the author. + +4. You may modify and include the part of the software into any other + software (possibly commercial). But some files in the distribution + are not written by the author, so that they are not under these terms. + + For the list of those files and their copying conditions, see the + file LEGAL. + +5. The scripts and library files supplied as input to or produced as + output from the software do not automatically fall under the + copyright of the software, but belong to whomever generated them, + and may be sold commercially, and may be aggregated with this + software. + +6. THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + PURPOSE. + +============================================================================== +timeout (Ruby / BSD-2-Clause) +https://github.com/ruby/timeout +============================================================================== + +--- BSDL --- +Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +SUCH DAMAGE. + +--- COPYING --- +Ruby is copyrighted free software by Yukihiro Matsumoto . +You can redistribute it and/or modify it under either the terms of the +2-clause BSDL (see the file BSDL), or the conditions below: + 1. You may make and give away verbatim copies of the source form of the software without restriction, provided that you duplicate all of the original copyright notices and associated disclaimers.