|
| 1 | +# Security Policy |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +Web3 Skills Tracker is a client-side React application designed to help developers track their Web3 skills and career progress. We take security seriously and are committed to ensuring the safety of our users' data. |
| 6 | + |
| 7 | +## Supported Versions |
| 8 | + |
| 9 | +We currently provide security updates for the following versions: |
| 10 | + |
| 11 | +| Version | Supported | Status | |
| 12 | +| ------- | ------------------ | ------ | |
| 13 | +| Latest(v3.1) | Yes | Active development | |
| 14 | +| 3.0.x | ⚠️ Limited support | devlopment stopped | |
| 15 | +<!-- | 3.x | :white_check_mark: | Active development | |
| 16 | +| 2.x | :white_check_mark: | Security fixes only | |
| 17 | +| < 2.0 | :x: | No longer supported | --> |
| 18 | + |
| 19 | + |
| 20 | +## Data Storage & Privacy |
| 21 | + |
| 22 | +### Local Storage Only |
| 23 | +- All user data (skills, progress, preferences) is stored exclusively in your browser's localStorage |
| 24 | +- **No data is sent to external servers** |
| 25 | +- **No user tracking or analytics** |
| 26 | +- **No cookies for tracking purposes** |
| 27 | +- Your progress data never leaves your device unless you explicitly share or export it |
| 28 | + |
| 29 | +### Shared Data |
| 30 | +When you use the "Share" feature: |
| 31 | +- Only your **checked skills** are encoded in the share code |
| 32 | +- No personal information is included |
| 33 | +- Share codes are generated client-side using base64 encoding |
| 34 | +- You control who you share the code with |
| 35 | + |
| 36 | +### Export/Import Functionality |
| 37 | +- JSON exports contain only your skills data and timestamps |
| 38 | +- No sensitive or personal information is included |
| 39 | +- Files are generated and processed entirely in your browser |
| 40 | +- We recommend storing exported files securely |
| 41 | + |
| 42 | +## Third-Party Dependencies |
| 43 | + |
| 44 | +### NPM Packages |
| 45 | +We use the following trusted packages: |
| 46 | +- **React**: UI framework (MIT License) |
| 47 | +- **Lucide React**: Icon library (ISC License) |
| 48 | +- **Tailwind CSS**: Styling framework (MIT License) |
| 49 | + |
| 50 | +### External Links |
| 51 | +Our application includes links to educational resources: |
| 52 | +- Cyfrin Updraft |
| 53 | +- Turbin3 |
| 54 | +- Ethereum.org |
| 55 | +- Solidity Documentation |
| 56 | +- Various Web3 learning platforms |
| 57 | + |
| 58 | +**Note**: We are not responsible for the content or security of external websites. |
| 59 | + |
| 60 | +## Security Best Practices for Users |
| 61 | + |
| 62 | +### Protecting Your Data |
| 63 | +1. **Backup Regularly**: Use the Export feature to create JSON backups of your progress |
| 64 | +2. **Secure Share Codes**: Only share your profile code with trusted individuals |
| 65 | +3. **Browser Security**: Keep your browser updated for latest security patches |
| 66 | +4. **Clear Cache Carefully**: Clearing browser data will delete your progress (export first!) |
| 67 | + |
| 68 | +### Importing Data |
| 69 | +When importing JSON files: |
| 70 | +- Only import files you created or trust completely |
| 71 | +- The app validates JSON structure but cannot detect malicious modifications |
| 72 | +- Importing will overwrite your current progress |
| 73 | + |
| 74 | +## Reporting a Vulnerability |
| 75 | + |
| 76 | +We appreciate the security research community's efforts to help keep our users safe. |
| 77 | + |
| 78 | +### How to Report |
| 79 | + |
| 80 | +If you discover a security vulnerability, please report it by: |
| 81 | + |
| 82 | +1. **Email**: Contact the maintainer at `mirmohmmadluqman@github` or create a private security advisory |
| 83 | +2. **GitHub Security Advisory**: Use the [Security tab](https://github.com/mirmohmmadluqman/web3skills/security/advisories) to report privately |
| 84 | +3. **NOT through public issues**: Please do not disclose security vulnerabilities publicly |
| 85 | + |
| 86 | +### What to Include |
| 87 | + |
| 88 | +Please provide: |
| 89 | +- Description of the vulnerability |
| 90 | +- Steps to reproduce |
| 91 | +- Potential impact |
| 92 | +- Suggested fix (if any) |
| 93 | +- Your contact information for follow-up |
| 94 | + |
| 95 | +### Response Timeline |
| 96 | + |
| 97 | +- **Initial Response**: Within 48 hours of report |
| 98 | +- **Status Update**: Every 5 business days until resolved |
| 99 | +- **Fix Timeline**: Critical issues within 7 days, others within 30 days |
| 100 | +- **Public Disclosure**: After fix is deployed and tested |
| 101 | + |
| 102 | +### What to Expect |
| 103 | + |
| 104 | +**If Accepted**: |
| 105 | +- We'll work with you to understand and reproduce the issue |
| 106 | +- You'll be credited in the release notes (unless you prefer anonymity) |
| 107 | +- We'll notify you when the fix is deployed |
| 108 | + |
| 109 | +**If Declined**: |
| 110 | +- We'll explain why the reported issue isn't considered a vulnerability |
| 111 | +- You're welcome to seek a second opinion |
| 112 | + |
| 113 | +## Security Considerations |
| 114 | + |
| 115 | +### Client-Side Application |
| 116 | +Since this is a client-side only application: |
| 117 | +- There are no server-side vulnerabilities |
| 118 | +- No database to secure |
| 119 | +- No API endpoints to protect |
| 120 | +- No user authentication system |
| 121 | + |
| 122 | +### Potential Risks |
| 123 | +The main security considerations are: |
| 124 | +1. **XSS Prevention**: We sanitize all user inputs |
| 125 | +2. **localStorage Access**: Other scripts on your domain could access data |
| 126 | +3. **Import Validation**: JSON imports are validated for structure |
| 127 | +4. **Share Code Safety**: Codes contain only skill names (no executable code) |
| 128 | + |
| 129 | +## Code Security |
| 130 | + |
| 131 | +### Development Practices |
| 132 | +- Dependencies are regularly updated |
| 133 | +- No eval() or dangerous functions used |
| 134 | +- Input validation on all user data |
| 135 | +- Safe JSON parsing with try/catch blocks |
| 136 | +- No inline scripts or unsafe HTML rendering |
| 137 | + |
| 138 | +### Open Source |
| 139 | +- Full source code available for audit |
| 140 | +- Community contributions welcome |
| 141 | +- All changes reviewed before merging |
| 142 | + |
| 143 | +## Compliance |
| 144 | + |
| 145 | +### Data Protection |
| 146 | +- **GDPR Compliant**: No personal data collected |
| 147 | +- **CCPA Compliant**: No data sold or shared with third parties |
| 148 | +- **No cookies**: Except essential localStorage for functionality |
| 149 | + |
| 150 | +### Licensing |
| 151 | +- MIT License - Free and open source |
| 152 | +- ShadCN/UI components used under MIT License |
| 153 | +- Unsplash images used under Unsplash License |
| 154 | + |
| 155 | +## Updates & Notifications |
| 156 | + |
| 157 | +### Security Updates |
| 158 | +- Critical security fixes are released immediately |
| 159 | +- Users are notified via GitHub releases |
| 160 | +- Update instructions provided in release notes |
| 161 | + |
| 162 | +### Staying Informed |
| 163 | +- Watch the repository for security updates |
| 164 | +- Check [Releases](https://github.com/mirmohmmadluqman/web3skills/releases) regularly |
| 165 | +- Join RiWoT community Discord for announcements |
| 166 | + |
| 167 | +## Acknowledgments |
| 168 | + |
| 169 | +We thank the following for their security contributions: |
| 170 | +- The React security team for framework security |
| 171 | +- The open-source community for dependency maintenance |
| 172 | +- Security researchers who report vulnerabilities responsibly |
| 173 | + |
| 174 | +## Contact |
| 175 | + |
| 176 | +- **Maintainer**: [@mirmohmmadluqman](https://github.com/mirmohmmadluqman) |
| 177 | +- **Organization**: RiWoT |
| 178 | +- **Discord**: [https://discord.gg/epWxxeWC](https://discord.gg/epWxxeWC) |
| 179 | +- **Repository**: [web3skills](https://github.com/mirmohmmadluqman/web3skills) |
| 180 | + |
| 181 | +--- |
| 182 | + |
| 183 | +**Last Updated**: 13 November 2025 |
| 184 | +**Version**: 3.1 |
0 commit comments