Files

Samir Boulahtit 11ebb2116a docs: add security policy and deployment guide

- Add SECURITY.md with vulnerability reporting process
- Add comprehensive deployment guide (docs/deployment/index.md)
- Generate uv.lock for reproducible builds
- Update audit rules to check correct deployment path
- Remove Node.js dependency, use Tailwind CLI standalone

Resolves audit warnings:
- THIRD-DEP-001: Dependency lock file
- DOC-SEC-001: Security policy
- DOC-OPS-001: Deployment documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2025-12-28 11:45:03 +01:00

1.7 KiB

Raw Blame History

Security Policy

Supported Versions

Version	Supported
1.x.x	✅

Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it responsibly:

Do not open a public issue
Email the security team at: security@wizamart.com
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

Response Timeline

Acknowledgment: Within 48 hours
Initial Assessment: Within 5 business days
Resolution Target: Within 30 days for critical issues

Security Measures

This application implements the following security measures:

Authentication & Authorization

JWT-based authentication with token expiration
Role-based access control (RBAC)
Vendor isolation (multi-tenant security)
Session management with secure cookies

Data Protection

Password hashing using bcrypt
API key encryption at rest
HTTPS enforcement in production
Input validation and sanitization

API Security

Rate limiting on authentication endpoints
CORS configuration
Request logging and audit trails
SQL injection prevention via ORM

Infrastructure

Environment-based configuration
Secrets management (no hardcoded credentials)
Database connection pooling
Error handling without information leakage

Security Updates

Security updates are released as patch versions and announced through:

Release notes
Security advisories (for critical issues)

Compliance

This application is designed with consideration for:

GDPR (data protection)
PCI-DSS awareness (payment handling delegated to processors)
OWASP Top 10 mitigation

1.7 KiB Raw Blame History