# Security Policy
## Supported Versions
| 0.4.x | :white_check_mark: |
| 0.3.x | :white_check_mark: |
| < 0.3 | :x: |
## Reporting a Vulnerability
We take security vulnerabilities in cc-audit seriously. If you discover a security issue, please report it responsibly.
### How to Report
1. **Do NOT** create a public GitHub issue for security vulnerabilities
2. Report vulnerabilities via [GitHub Security Advisories](https://github.com/ryo-ebata/cc-audit/security/advisories/new)
3. Include the following information:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
### What to Expect
- **Initial Response**: Within 48 hours
- **Status Update**: Within 7 days
- **Resolution Timeline**: Depends on severity
- Critical: 7 days
- High: 14 days
- Medium: 30 days
- Low: 90 days
### Disclosure Policy
- We follow responsible disclosure practices
- Security issues will be fixed before public disclosure
- Credit will be given to reporters (unless anonymity is requested)
## Security Considerations for Users
### Safe Usage
cc-audit is designed to analyze potentially malicious code. When using this tool:
1. **Isolated Environment**: Run in a sandboxed or isolated environment when scanning untrusted code
2. **Review Results**: Carefully review all findings before taking action
3. **Keep Updated**: Always use the latest version for the most up-to-date detection rules
### Known Limitations
- Static analysis cannot detect all malicious patterns
- False positives are possible; always verify findings
- Dynamic or obfuscated malware may evade detection
## Security Features
cc-audit includes several security-focused features:
- **No Code Execution**: Pure static analysis without executing scanned code
- **Sandboxed Parsing**: Safe parsing of configuration files
- **Input Validation**: Strict validation of all inputs
- **Minimal Dependencies**: Reduced attack surface through careful dependency management
## Dependency Security
We regularly audit dependencies for known vulnerabilities:
```bash
cargo audit
```
All dependencies are:
- Pinned to specific versions in Cargo.lock
- Regularly updated to address security issues
- Reviewed before inclusion