waw/SECURITY.md

waw is a minimalistic Node.js framework that serves as a foundation for building various types of projects. The core framework itself contains almost no code—its functionality is driven entirely by the modules you choose to include, making it highly flexi

# Security Policy

## Reporting Security Issues

If you discover a security vulnerability in waw, please follow these steps:

1. **Do not disclose it publicly** – Avoid sharing details in public forums, issue trackers, or discussions.
2. **Report it privately** – Contact the project maintainers directly by email or another secure channel.
3. **Provide details** – Include a clear description of the issue, steps to reproduce, and any potential impact.
4. **Allow time for resolution** – The maintainers will investigate and address the vulnerability before public disclosure.

## Supported Versions

We release security updates for the latest major version of waw. Users are encouraged to keep their projects updated to the most recent release.

| Version  | Supported              |
| -------- | ---------------------- |
| 25.x.x   | ✅ Active support      |
| < 25.0.0 | ❌ No longer supported |

## Security Best Practices

To ensure the security of your waw-based projects, follow these best practices:

-   **Keep dependencies updated** – Run `npm update` regularly.
-   **Use environment variables** – Store sensitive information like API keys in environment variables.
-   **Validate user input** – Prevent security vulnerabilities like SQL injection and XSS attacks.
-   **Limit permissions** – Grant only the necessary access rights to files and services.
-   **Monitor logs** – Regularly check logs for suspicious activity.

## Contact

For any security-related concerns, please reach out to the maintainers through the official communication channels.