mirror of
https://github.com/QuantumNous/new-api.git
synced 2026-03-30 05:20:18 +00:00
d72cfc8590
Updated the reporting method for security issues to include a link to the draft security advisory.
87 lines
3.9 KiB
Markdown
87 lines
3.9 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
We provide security updates for the following versions:
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| Latest | :white_check_mark: |
|
|
| Older | :x: |
|
|
|
|
We strongly recommend that users always use the latest version for the best security and features.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take security vulnerability reports very seriously. If you discover a security issue, please follow the steps below for responsible disclosure.
|
|
|
|
### How to Report
|
|
|
|
**Do NOT** report security vulnerabilities in public GitHub Issues.
|
|
|
|
To report a security issue, please use the GitHub Security Advisories tab to "[Open a draft security advisory](https://github.com/QuantumNous/new-api/security/advisories/new)". This is the preferred method as it provides a built-in private communication channel.
|
|
|
|
Alternatively, you can report via email:
|
|
|
|
- **Email:** support@quantumnous.com
|
|
- **Subject:** `[SECURITY] Security Vulnerability Report`
|
|
|
|
### What to Include
|
|
|
|
To help us understand and resolve the issue more quickly, please include the following information in your report:
|
|
|
|
1. **Vulnerability Type** - Brief description of the vulnerability (e.g., SQL injection, XSS, authentication bypass, etc.)
|
|
2. **Affected Component** - Affected file paths, endpoints, or functional modules
|
|
3. **Reproduction Steps** - Detailed steps to reproduce
|
|
4. **Impact Assessment** - Potential security impact and severity assessment
|
|
5. **Proof of Concept** - If possible, provide proof of concept code or screenshots (do not test in production environments)
|
|
6. **Suggested Fix** - If you have a fix suggestion, please provide it
|
|
7. **Your Contact Information** - So we can communicate with you
|
|
|
|
## Response Process
|
|
|
|
1. **Acknowledgment:** We will acknowledge receipt of your report within **48 hours**.
|
|
2. **Initial Assessment:** We will complete an initial assessment and communicate with you within **7 days**.
|
|
3. **Fix Development:** Based on the severity of the vulnerability, we will prioritize developing a fix.
|
|
4. **Security Advisory:** After the fix is released, we will publish a security advisory (if applicable).
|
|
5. **Credit:** If you wish, we will credit your contribution in the security advisory.
|
|
|
|
## Security Best Practices
|
|
|
|
When deploying and using New API, we recommend following these security best practices:
|
|
|
|
### Deployment Security
|
|
|
|
- **Use HTTPS:** Always serve over HTTPS to ensure transport layer security
|
|
- **Firewall Configuration:** Only open necessary ports and restrict access to management interfaces
|
|
- **Regular Updates:** Update to the latest version promptly to receive security patches
|
|
- **Environment Isolation:** Use separate database and Redis instances in production
|
|
|
|
### API Key Security
|
|
|
|
- **Key Protection:** Do not expose API keys in client-side code or public repositories
|
|
- **Least Privilege:** Create different API keys for different purposes, following the principle of least privilege
|
|
- **Regular Rotation:** Rotate API keys regularly
|
|
- **Monitor Usage:** Monitor API key usage and detect anomalies promptly
|
|
|
|
### Database Security
|
|
|
|
- **Strong Passwords:** Use strong passwords to protect database access
|
|
- **Network Isolation:** Database should not be directly exposed to the public internet
|
|
- **Regular Backups:** Regularly backup the database and verify backup integrity
|
|
- **Access Control:** Limit database user permissions, following the principle of least privilege
|
|
|
|
## Security-Related Configuration
|
|
|
|
Please ensure the following security-related environment variables and settings are properly configured:
|
|
|
|
- `SESSION_SECRET` - Use a strong random string
|
|
- `SQL_DSN` - Ensure database connection uses secure configuration
|
|
- `REDIS_CONN_STRING` - If using Redis, ensure secure connection
|
|
|
|
For detailed configuration instructions, please refer to the project documentation.
|
|
|
|
## Disclaimer
|
|
|
|
This project is provided "as is" without any express or implied warranty. Users should assess the security risks of using this software in their environment.
|