We release patches for security vulnerabilities for the following versions:

We take the security of this project seriously. If you believe you have found a security vulnerability, please report it to us as described below.

• Open a public GitHub issue for security vulnerabilities
• Disclose the vulnerability publicly before it has been addressed

Report security vulnerabilities via email to: [INSERT CONTACT EMAIL]

Please include the following information in your report:

1. Type of vulnerability (e.g., NoSQL injection, XSS, authentication bypass)
2. Full paths of affected source files (if known)
3. Location of the affected source code (tag/branch/commit or direct URL)
4. Step-by-step instructions to reproduce the vulnerability
5. Proof-of-concept or exploit code (if possible)
6. Impact of the vulnerability including how an attacker might exploit it

• Acknowledgment: We will acknowledge receipt of your vulnerability report within 48 hours
• Updates: We will send you regular updates about our progress
• Verification: We will work to verify and reproduce the vulnerability
• Timeline: We aim to release a fix within 90 days of receiving the report
• Credit: We will credit you for the discovery when we announce the fix (unless you prefer to remain anonymous)

1. Never commit secrets

   • No API keys, passwords, or tokens in code
   • Use environment variables for sensitive data
   • Check .gitignore includes common secret files

2. Input validation

   • Always validate and sanitize user input
   • Use Zod schemas with validate() middleware
   • Never trust client-side data

3. NoSQL Injection prevention

   • Never pass raw req.body directly into MongoDB queries
   • Use Zod to validate and parse input before DB operations
   • Avoid $where and $expr with user input

4. Authentication & Authorization

   • Implement proper JWT token validation
   • Use guards for all protected routes
   • Verify user permissions before sensitive operations
   • Implement rate limiting on auth endpoints

5. Dependency management

   • Keep dependencies up to date
   • Review Dependabot alerts
   • Run npm audit regularly
   • Use lock files (package-lock.json)

1. Environment Configuration

   # Use strong secrets
   JWT_SECRET=<strong-random-string-minimum-32-characters>
   
   # Enable CORS appropriately
   CORS_ORIGIN=https://your-domain.com
   
   # Use secure database credentials
   MONGODB_URL=mongodb+srv://user:password@cluster.mongodb.net/dbname

2. HTTPS Only

   • Always use HTTPS in production
   • Redirect HTTP to HTTPS
   • Use secure cookies (secure: true, httpOnly: true)

3. Rate Limiting

   • Implement rate limiting on all endpoints
   • Extra strict limits on auth endpoints
   • Use IP-based and user-based limits

4. Security Headers

   • Helmet.js is configured for security headers
   • Configure CSP appropriately
   • Enable HSTS

5. Monitoring & Logging

   • Winston logs security events to file
   • Monitor for suspicious activity
   • Set up alerts for critical events
   • Never log sensitive information (passwords, tokens)

• All database queries use Mongoose ODM methods
• Zod validation prevents NoSQL injection by type-checking input
• Database credentials stored in environment variables
• Zod env validation crashes the app if required vars are missing

• JWT tokens with configurable expiration
• Password hashing with bcrypt (cost factor 12+)
• Rate limiting on login/register attempts
• Sensitive fields excluded from responses (select: false)

• CORS configured for specific origins (via CORS_ORIGIN env var)
• Helmet.js for security headers
• Request validation with Zod middleware
• Rate limiting with Redis-backed store (express-rate-limit)

We will announce security updates through:

1. GitHub Security Advisories
2. Email to registered users (if applicable)
3. CHANGELOG.md with [SECURITY] prefix

This project aims to comply with:

• OWASP Top 10
• SANS Top 25
• CWE/SANS Top 25 Most Dangerous Software Errors

• OWASP Top 10
• Express.js Security Best Practices
• Node.js Security Checklist
• Mongoose Security

We thank the following researchers for responsibly disclosing security vulnerabilities: