• 🔒 Security Policy
  • 📋 Table of Contents
  • 🛡️ Supported Versions
  • 🚨 Reporting a Vulnerability
    • 🔐 Private Reporting (Recommended)
    • 📧 Alternative Reporting Methods
    • 📋 What to Include in Your Report
  • ⏱️ Response Timeline
  • 🛠️ Security Best Practices
    • For Users
    • For Contributors
  • 🏆 Security Acknowledgments
  • 📞 Contact Information

We maintain security updates only for the latest version of dbterd:

We appreciate responsible disclosure of security vulnerabilities. Your efforts help keep the dbterd community safe.

The most secure way to report vulnerabilities is through GitHub's private vulnerability reporting system:

1. Navigate to: Report Security Vulnerability
2. Use Title Format: [SECURITY] Brief description of the issue
3. Fill out all required fields with detailed information
4. Submit - Only maintainers will have access to your report

If GitHub's private reporting is unavailable:

• Security Advisory: Create New Advisory
• Direct Contact: Reach out to maintainers through secure channels

To help us address the vulnerability quickly, please include:

Required Information:

• Vulnerability Type: (e.g., injection, authentication bypass, data exposure)
• Affected Components: Specific modules, functions, or endpoints
• Attack Vector: How the vulnerability can be exploited
• Impact Assessment: Potential consequences of exploitation
• Affected Versions: Which versions are vulnerable

Helpful Additions:

• Proof of Concept: Step-by-step reproduction steps
• Suggested Fix: If you have ideas for remediation
• CVSS Score: If you've calculated one
• References: Related CVEs or security advisories

We are committed to responding promptly to security reports:

Response Process:

1. Acknowledge receipt of your report
2. Validate and reproduce the vulnerability
3. Assess impact and severity
4. Develop and test patches
5. Coordinate disclosure timeline
6. Release security updates
7. Publish security advisory (if applicable)

Installation & Updates:

• ✅ Always install from official sources (PyPI: pip install dbterd)
• ✅ Keep dbterd updated to the latest version
• ✅ Regularly update dependencies: pip install dbt-artifacts-parser --upgrade
• ✅ Use virtual environments to isolate dependencies

Configuration Security:

• 🔐 Never commit credentials or API keys to version control
• 🔐 Use environment variables for sensitive configuration
• 🔐 Implement proper access controls for dbt artifact files
• 🔐 Review generated ERDs before sharing publicly

Runtime Security:

• 🛡️ Run dbterd in secure, isolated environments
• 🛡️ Limit file system access permissions
• 🛡️ Monitor for unusual activity or errors
• 🛡️ Validate input files before processing

Development Security:

• 🔒 Follow secure coding practices
• 🔒 Never commit secrets, keys, or credentials
• 🔒 Use dependency scanning tools
• 🔒 Implement input validation and sanitization
• 🔒 Write security-focused tests

Code Review Requirements:

• 👥 All changes require security-aware code review
• 👥 Pay special attention to file I/O operations
• 👥 Validate any external dependencies
• 👥 Test with malformed/malicious inputs

We believe in recognizing those who help improve our security:

Hall of Fame - Security researchers who have responsibly disclosed vulnerabilities:

• Your name could be here! We appreciate responsible disclosure.

Recognition Process:

• Public acknowledgment in release notes
• Credit in security advisories
• Optional listing in this document
• Our heartfelt gratitude! 🙏

Security Team:

• Primary Contact: @datnguye
• GitHub Security: Security Tab
• Community: Discussions

For Non-Security Issues:

• 🐛 Bug Reports
• 💡 Feature Requests
• 📖 Documentation