Skip to content

SECURITY.md

Latest commit

 

History

History
145 lines (101 loc) · 4.15 KB

SECURITY.md

File metadata and controls

145 lines (101 loc) · 4.15 KB
Raw

Security Policy

Supported Versions

The following versions of FizzBuzz Enterprise Edition are currently supported with security updates:

Version Supported
4.2.x ✅
4.1.x ✅
4.0.x ❌
3.x.x ❌
< 3.0 ❌

Reporting a Vulnerability

The FizzBuzz Platform Team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings.

Reporting Process

  1. DO NOT create a public GitHub issue for security vulnerabilities
  2. Email security@fizzbuzz.enterprise with details of the vulnerability
  3. Include the following information:
    • Description of the vulnerability
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if any)

What to Expect

  • Acknowledgment: Within 24 hours of your report
  • Initial Assessment: Within 72 hours
  • Resolution Timeline: Dependent on severity (see below)
  • Disclosure: Coordinated with reporter

Severity Levels and Response Times

Severity Description Response Time
Critical Remote code execution, data breach 24 hours
High Authentication bypass, privilege escalation 72 hours
Medium Information disclosure, DoS 7 days
Low Minor information leaks 30 days

Security Considerations

FizzBuzz-Specific Security Concerns

Prompt Injection

The Fizz and Buzz services use LLM prompts to determine divisibility. We have implemented the following safeguards:

  1. Input Validation: Numbers are validated before being sent to the LLM
  2. Prompt Hardening: System prompts include explicit instructions to only return boolean values
  3. Output Validation: LLM responses are parsed and validated before use
  4. Monitoring: Anomalous responses trigger alerts

See ADR-031 for a case study on prompt-related issues.

Kafka Security

  • All Kafka connections use TLS encryption
  • Authentication via SASL/SCRAM
  • Topic-level ACLs restrict access
  • Consumer groups are isolated per service

API Security

  • GraphQL depth limiting prevents DoS
  • Rate limiting per client
  • Input validation on all endpoints
  • CORS configured for allowed origins only

Data Security

  • No PII is processed (numbers only)
  • Audit logs are retained for 90 days
  • Encryption at rest for all data stores

Dependency Management

  • Dependencies are automatically scanned via Dependabot
  • Critical vulnerabilities are patched within 24 hours
  • Monthly dependency audit reviews

Secrets Management

  • All secrets stored in environment variables or secret managers
  • No secrets in code or configuration files
  • API keys are rotated quarterly
  • See docs/security/secrets-rotation.md

Bug Bounty Program

We offer bounties for qualifying security reports:

Severity Bounty
Critical $500
High $250
Medium $100
Low $50

Qualifying Reports

To qualify for a bounty:

  • Report must be first of its kind
  • Vulnerability must be in supported versions
  • Report must include reproduction steps
  • Reporter must allow reasonable time for fix

Out of Scope

  • Social engineering attacks
  • Physical security issues
  • Issues in third-party dependencies (report to upstream)
  • Issues requiring unlikely user interaction
  • Theoretical vulnerabilities without proof of concept

Security Contacts

Compliance

FizzBuzz Enterprise Edition is designed with compliance in mind:

  • SOC 2 Type II: Certification in progress
  • GDPR: No PII processed
  • HIPAA: Not applicable (no PHI)
  • FedRAMP: Available on Government tier

Security Updates

Security advisories are published at:

Thank you for helping keep FizzBuzz Enterprise Edition secure.