At MitraBooks, we take the security of our software seriously. We appreciate the efforts of security researchers and users who help us maintain the highest security standards.

We provide security updates for the following versions:

Note: Once we release version 1.0.0, we will support:

• Latest major version (e.g., 1.x.x)
• Previous major version (e.g., 0.x.x) for 6 months after new major release

Please do NOT report security vulnerabilities through public GitHub issues.

1. Email: security@mitrabooks.com
2. Subject: [SECURITY] Brief description
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)
   • Your contact information

We use the following severity ratings:

• Remote code execution
• SQL injection
• Authentication bypass
• Data breach potential
• SLA: Fix within 7 days

• Privilege escalation
• XSS (stored)
• CSRF
• Sensitive data exposure
• SLA: Fix within 14 days

• XSS (reflected)
• Information disclosure (non-sensitive)
• Missing security headers
• SLA: Fix within 30 days

• Security best practice violations
• Non-exploitable issues
• SLA: Fix in next minor release

# Use strong passwords
- Minimum 12 characters
- Mix of uppercase, lowercase, numbers, symbols
- No dictionary words

# Enable Two-Factor Authentication (2FA)
# Rotate passwords every 90 days
# Use unique passwords for each service

# Never commit .env files
echo ".env" >> .gitignore

# Use strong secrets
SECRET_KEY=$(openssl rand -base64 32)
JWT_SECRET_KEY=$(openssl rand -base64 32)

# Different secrets for each environment
# Production secrets should be stored in secret management systems

# Use strong database passwords
POSTGRES_PASSWORD=$(openssl rand -base64 24)

# Restrict database access
# PostgreSQL: Configure pg_hba.conf
# MongoDB: Enable authentication

# Regular backups
# Encrypted backups for production

# Always use HTTPS in production
# Get free SSL from Let's Encrypt
# Enable HSTS headers
# Disable insecure protocols (TLS 1.0, 1.1)

# Rate limiting enabled
# API key rotation every 90 days
# Monitor API usage
# Log all API calls

# Don't run containers as root
# Use official base images
# Scan images for vulnerabilities
docker scan mitrabooks:latest

# Keep images updated
# Limit container resources

MitraBooks includes the following security features:

• JWT (JSON Web Tokens)
• Password hashing (bcrypt)
• Two-Factor Authentication (2FA)
• Session management
• Account lockout (after failed attempts)

• Role-Based Access Control (RBAC)
• Permission-based access
• Multi-tenant data isolation
• Row-level security

• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.3)
• Field-level encryption (sensitive data)
• Database encryption
• Secure backup encryption

• Complete audit trail
• Immutable logs (MongoDB)
• Activity monitoring
• Suspicious activity detection
• Failed login tracking

• SQL injection prevention
• XSS prevention
• CSRF protection
• Request validation (Pydantic)
• File upload validation

• Rate limiting
• IP whitelisting
• API key authentication
• OAuth2 support
• CORS configuration

• Automated vulnerability scanning
• Regular dependency updates
• Security advisories monitoring

• Data Residency: Data stored in India (AWS Mumbai region)
• Data Portability: Export your data anytime
• Right to Erasure: Delete your data on request
• Data Minimization: Collect only necessary data
• Transparency: Clear privacy policy

See PRIVACY.md for details.

Status: Coming in Q2 2025

Scope:

• Web application
• API
• Mobile app
• Desktop app

Rewards:

• Critical: $500 - $1,000
• High: $250 - $500
• Medium: $100 - $250
• Low: $50 - $100

Out of Scope:

• Social engineering
• Physical attacks
• DoS/DDoS attacks
• Spam/Brute force

If we discover a security incident:

1. Immediate Actions (0-2 hours)

   • Contain the incident
   • Assess scope and impact
   • Notify leadership

2. Communication (2-24 hours)

   • Notify affected users (email)
   • Post public disclosure (blog)
   • Coordinate with authorities (if required)

3. Remediation (24-72 hours)

   • Deploy fixes
   • Conduct forensics
   • Strengthen defenses

4. Post-Incident (1 week)

   • Public post-mortem
   • Implement preventive measures
   • Update security policies

• No hardcoded secrets
• Input validation implemented
• SQL queries parameterized
• XSS prevention in place
• CSRF tokens used
• Authentication checked
• Authorization verified
• Sensitive data encrypted
• Error messages sanitized (no info disclosure)
• Security tests passed

• Environment variables configured
• SSL/TLS enabled
• Database secured
• Backups configured
• Monitoring enabled
• Rate limiting active
• Security headers set
• Dependency vulnerabilities checked
• Penetration testing completed (production)

• Bandit - Python security linter
• ESLint - JavaScript security rules
• SonarQube - Code quality & security

• Dependabot - Automated dependency updates
• Snyk - Vulnerability scanning
• pip-audit - Python package auditing

• OWASP ZAP - Dynamic security testing
• ModSecurity - Web application firewall

• Sentry - Error tracking
• Prometheus - Metrics
• ELK Stack - Log analysis

We follow responsible disclosure practices:

1. Private Disclosure (30-90 days)

   • Work with reporter to understand issue
   • Develop and test fix
   • Prepare advisory

2. Coordinated Disclosure

   • Notify affected users
   • Release fix
   • Publish security advisory

3. Public Disclosure (after fix)

   • CVE assignment (if applicable)
   • Credit security researcher
   • Update changelog

Security researchers who responsibly disclose vulnerabilities will be:

• Listed in our Hall of Fame
• Credited in release notes
• Eligible for rewards (bug bounty program)

Primary: security@mitrabooks.com
PGP Key: Download

Response Time:

• Critical: < 4 hours
• High: < 24 hours
• Medium: < 48 hours
• Low: < 7 days

• OWASP Top 10
• CWE Top 25
• NIST Cybersecurity Framework

This security policy may be updated from time to time. Check back regularly for updates.

Last Updated: December 1, 2024
Version: 1.0

Thank you for helping keep MitraBooks and our users safe! 🔒