Use this section to tell people about which versions of your project are currently being supported with security updates.
| Version | Supported |
|---|---|
| 1.0.x | ✅ |
| < 1.0 | ❌ |
We take the security of this project seriously. If you believe you have found a security vulnerability, please report it to us as described below.
- Do not create a public GitHub issue for the vulnerability
- Email the details to: david@mountain-web-studio.com
- Include the following information:
- Description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Suggested fix (if any)
- Initial Response: Within 48 hours
- Assessment: We will assess the reported vulnerability
- Updates: We will keep you informed of our progress
- Fix Timeline: We will work to fix the issue as quickly as possible
- Credit: We will credit you in our security advisories (unless you prefer to remain anonymous)
We follow responsible disclosure practices:
- No Public Disclosure: Vulnerabilities will not be publicly disclosed until a fix is available
- Coordinated Release: Security fixes will be released with appropriate documentation
- Credit: Contributors will be credited for responsible disclosure
- Timeline: We will work to address issues within a reasonable timeframe
When using this project:
- Keep Dependencies Updated: Regularly update to the latest stable versions
- Review Code: Review any customizations or modifications
- Follow Angular Security: Follow Angular security best practices
- Use HTTPS: Always serve the application over HTTPS in production
- Content Security Policy: Implement appropriate CSP headers
This project includes several security features:
- Content Security Policy: Built-in CSP for XSS protection
- Input Validation: All user inputs are validated and sanitized
- No External Scripts: No external scripts are loaded without explicit consent
- HTTPS Only: Production builds enforce HTTPS
- Secure Headers: Appropriate security headers are configured
Currently, there are no known security vulnerabilities in this project.
Security updates will be released as patch versions (e.g., 1.0.1, 1.0.2) and will be clearly marked in the changelog.
For security-related questions or concerns:
- Email: david@mountain-web-studio.com
- GitHub Issues: For non-sensitive security questions
- Private Disclosure: Use email for sensitive security reports
Thank you for helping keep this project secure! 🔒