waw/SECURITY.md

**waw** is a minimal Node.js (≥ 24) platform that loads **modules** and either:

# Security Policy

## Reporting Security Issues

If you discover a security vulnerability in waw, please follow these steps:

1. **Do not disclose it publicly** – Avoid sharing details in public forums, issue trackers, or discussions.
2. **Report it privately** – Contact the project maintainers directly by email or another secure channel.
3. **Provide details** – Include a clear description of the issue, steps to reproduce, and any potential impact.
4. **Allow time for resolution** – The maintainers will investigate and address the vulnerability before public disclosure.

## Supported Versions

We release security updates for the latest major version of waw. Users are encouraged to keep their projects updated to the most recent release.

| Version  | Supported              |
| -------- | ---------------------- |
| 26.x.x   | ✅ Active support      |
| < 26.1.0 | ❌ No longer supported |

## Security Best Practices

To ensure the security of your waw-based projects, follow these best practices:

-   **Keep dependencies updated** – Run `npm update` regularly.
-   **Use environment variables** – Store sensitive information like API keys in environment variables.
-   **Validate user input** – Prevent security vulnerabilities like SQL injection and XSS attacks.
-   **Limit permissions** – Grant only the necessary access rights to files and services.
-   **Monitor logs** – Regularly check logs for suspicious activity.

If you discover a security vulnerability in waw, please:

1. **Do not disclose it publicly** – Avoid sharing details in public forums, issue trackers, or discussions.
2. **Report it privately** – Contact the project maintainers at [crackeraki@gmail.com](mailto:crackeraki@gmail.com) or via GitHub’s [private security advisory](https://github.com/WebArtWork/waw/security/advisories/new).
3. **Provide details** – Include a clear description of the issue, steps to reproduce, and any potential impact.
4. **Allow time for resolution** – We aim to respond within 3 business days. The maintainers will investigate and address the vulnerability before public disclosure.

## Contact

For any security-related concerns, please contact the maintainers using one of the following methods:

-   **Email:** [ceo@webart.work](mailto:ceo@webart.work)
-   **Phone:** +380971862487
-   **GitHub Issues:** [https://github.com/WebArtWork/waw/issues](https://github.com/WebArtWork/waw/issues)