DO NOT report security vulnerabilities through public GitHub issues.

Please report security vulnerabilities by:

1. Email: security@hyperpolymath.dev
2. GitHub Security Advisory: Create Advisory

Please include as much of the following information as possible:

• Type of vulnerability (e.g., authentication bypass, SQL injection, XSS)
• Full paths of source file(s) related to the vulnerability
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability (what an attacker could do)
• Suggested remediation (if you have one)

• Acknowledgment: Within 24 hours
• Initial Assessment: Within 72 hours
• Status Updates: Weekly
• Resolution Target: 30-90 days depending on severity

We follow coordinated disclosure:

1. Report received and acknowledged
2. Issue verified and assessed for severity
3. Fix developed and tested
4. Fix released to production
5. Public disclosure 30 days after fix (or by mutual agreement)

• Use strong tokens: Generate GitLab tokens with minimal required scopes
• Rotate tokens regularly: Change API tokens every 90 days
• Monitor access logs: Review GitLab audit logs for unexpected activity
• Use HTTPS: Always access via encrypted connections
• Keep updated: Install security updates promptly

• Never commit secrets: Use .env for sensitive data
• Validate input: Sanitize all user input
• Use prepared statements: Prevent injection attacks
• Keep dependencies updated: Run npm audit regularly
• Follow OWASP Top 10: Address common vulnerabilities
• Code review security: All PRs reviewed for security issues

• ✅ Secure token storage
• ✅ Minimum required permissions
• ✅ Token expiration support
• ✅ Audit logging

• ✅ HTTPS only
• ✅ No plain text password storage
• ✅ Encrypted data transmission
• ✅ Minimal data retention

• ✅ Input sanitization
• ✅ XSS prevention
• ✅ SQL injection protection
• ✅ Command injection prevention

• ✅ Regular dependency updates
• ✅ Automated vulnerability scanning
• ✅ npm audit in CI/CD
• ✅ Dependabot alerts enabled

• Claude GitLab Bridge application code
• GitLab integration components
• Claude API integration
• Authentication and authorization
• Data handling and storage
• Dependencies and third-party libraries

• Third-party services (GitLab, Anthropic Claude)
• Social engineering attacks
• Denial of Service (DoS) attacks
• Issues already reported
• Issues in deprecated versions

Security updates are released as:

• Critical: Within 24 hours
• High: Within 72 hours
• Medium: Within 14 days
• Low: Next regular release

We appreciate security researchers and offer:

• Acknowledgment in SECURITY.md (with permission)
• Credit in release notes (if desired)
• Public recognition in README (optional)

All security advisories are published at:

https://github.com/hyperpolymath/claude-gitlab-bridge/security/advisories

Subscribe to notifications to stay informed.

Sensitive configuration via environment variables:

# Required - Never commit these!
GITLAB_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxx
ANTHROPIC_API_KEY=sk-ant-xxxxxxxxxxxxxxxxxxxx
WEBHOOK_SECRET=your-webhook-secret-here

Minimum required scopes:

• api - Full API access
• read_repository - Read repository content
• write_repository - Create branches and commits

Avoid:

• sudo - Administrative access
• admin_mode - Admin mode access

Configure rate limits to prevent abuse:

{
  maxRequestsPerMinute: 60,
  maxRequestsPerHour: 1000
}

1. Immediately: Revoke API tokens
2. Review logs: Check for unauthorized access
3. Contact us: security@hyperpolymath.dev
4. Preserve evidence: Don't delete logs
5. Change credentials: Update all affected tokens

1. Triage: Assess severity and impact
2. Containment: Limit exposure and damage
3. Investigation: Determine root cause
4. Remediation: Implement fixes
5. Recovery: Restore normal operations
6. Lessons learned: Update processes

This project follows:

• ✅ OWASP Top 10
• ✅ CWE/SANS Top 25
• ✅ NIST Cybersecurity Framework
• ✅ GDPR (data protection)
• ✅ RFC 9116 (security.txt)

• General Security: security@hyperpolymath.dev
• Code of Conduct Issues: conduct@hyperpolymath.dev
• General Inquiries: hello@hyperpolymath.dev

• OWASP Top 10
• CWE Top 25
• GitLab Security
• Anthropic Security

Last Updated: 2024-11-28 Version: 1.0 Contact: security@hyperpolymath.dev