Use this section to tell people about which versions of your project are currently being supported with security updates.

We take the security of Rhema seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via email to security@fugue.ai.

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:

• Type of issue (buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the vulnerability
• The location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

This information will help us triage your report more quickly.

We prefer all communications to be in English.

Rhema follows the principle of Responsible Disclosure.

When contributing to Rhema, please follow these security best practices:

1. Input Validation: Always validate and sanitize user inputs
2. Authentication: Use secure authentication mechanisms
3. Authorization: Implement proper access controls
4. Data Protection: Encrypt sensitive data at rest and in transit
5. Dependencies: Keep dependencies updated and scan for vulnerabilities
6. Secrets Management: Never commit secrets or sensitive configuration
7. Error Handling: Avoid exposing sensitive information in error messages

When using Rhema in production:

1. Keep Updated: Regularly update to the latest stable version
2. Secure Configuration: Use secure configuration practices
3. Network Security: Implement proper network security controls
4. Monitoring: Monitor for suspicious activities
5. Backup: Maintain regular backups of your data
6. Access Control: Limit access to Rhema services to authorized personnel only

Rhema includes several security features:

• TLS/SSL Support: Secure communication protocols
• Authentication: Multiple authentication methods
• Authorization: Role-based access control
• Audit Logging: Comprehensive audit trails
• Input Validation: Robust input validation and sanitization
• Error Handling: Secure error handling without information disclosure

Security updates are released as patch versions (e.g., 0.1.1, 0.1.2) and should be applied as soon as possible. Critical security vulnerabilities may result in immediate releases.

When a security vulnerability is reported:

1. Initial Response: Within 48 hours
2. Assessment: Within 1 week
3. Fix Development: Timeline depends on complexity
4. Release: As soon as possible after fix is ready
5. Public Disclosure: After users have had time to update

We would like to thank all security researchers who responsibly disclose vulnerabilities to us. Their contributions help make Rhema more secure for everyone.

For security-related questions or concerns, please contact us at security@fugue.ai.