@libredb/studio 0.9.7

package/SECURITY.md

@@ -0,0 +1,107 @@
+# Security Policy
+
+## Supported Versions
+
+We actively support and provide security updates for the following versions of LibreDB Studio:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.5.x   | :white_check_mark: |
+| 0.4.x   | :white_check_mark: |
+| < 0.4.0 | :x:                |
+
+> **Note**: We recommend always using the latest version to ensure you have the most recent security patches.
+
+## Reporting a Vulnerability
+
+We take the security of LibreDB Studio seriously. If you believe you have found a security vulnerability, please report it to us as described below.
+
+### How to Report
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them via email to:
+
+**Email:** cevheribozoglan@gmail.com
+
+### What to Include
+
+When reporting a security vulnerability, please include the following information:
+
+- **Type of issue** (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
+- **Full paths of source file(s) related to the manifestation of the issue**
+- **The location of the affected source code** (tag/branch/commit or direct URL)
+- **Step-by-step instructions to reproduce the issue**
+- **Proof-of-concept or exploit code** (if possible)
+- **Impact of the issue**, including how an attacker might exploit the issue
+
+This information will help us triage your report more quickly.
+
+### What to Expect
+
+- **Acknowledgment**: We will acknowledge receipt of your vulnerability report within **48 hours**
+- **Initial Assessment**: We will provide an initial assessment within **7 days**
+- **Updates**: We will keep you informed of our progress every 7-10 days
+- **Resolution**: We will work with you to understand and resolve the issue quickly
+
+### Disclosure Policy
+
+- We will coordinate with you to fix the vulnerability before public disclosure
+- We will credit you for the discovery (unless you prefer to remain anonymous)
+- We will not take legal action against security researchers who:
+  - Act in good faith
+  - Do not access more data than necessary
+  - Do not modify or delete data
+  - Do not disrupt our services
+  - Report vulnerabilities promptly
+
+### Security Best Practices
+
+When using LibreDB Studio, please follow these security best practices:
+
+1. **Keep Updated**: Always use the latest version of LibreDB Studio
+2. **Secure Credentials**: Use strong passwords for `ADMIN_PASSWORD` and `USER_PASSWORD`
+3. **JWT Secret**: Generate a secure `JWT_SECRET` using `openssl rand -base64 32`
+4. **Environment Variables**: Never commit `.env.local` or `.env` files to version control
+5. **Network Security**: Deploy behind a firewall or VPN when accessing production databases
+6. **Database Access**: Use read-only database users when possible
+7. **HTTPS**: Always use HTTPS in production environments
+8. **API Keys**: Store LLM API keys securely and rotate them regularly
+
+### Known Security Considerations
+
+#### Authentication
+- LibreDB Studio uses JWT-based authentication
+- Passwords are hashed using industry-standard algorithms
+- Session tokens expire after a configurable period
+
+#### Database Connections
+- Connection strings are stored encrypted in browser localStorage
+- Database credentials are never logged or exposed in API responses
+- Connection pooling is used to prevent connection exhaustion
+
+#### API Security
+- All API endpoints require authentication (except `/api/auth/login`)
+- SQL injection protection is handled by parameterized queries
+- Rate limiting should be implemented at the infrastructure level
+
+#### AI/LLM Integration
+- API keys are stored server-side only
+- User queries sent to LLM providers may be logged by the provider
+- Consider privacy implications when using cloud-based LLM services
+
+### Security Updates
+
+Security updates will be released as:
+- **Patch releases** (e.g., 0.5.4 → 0.5.5) for critical security fixes
+- **Minor releases** (e.g., 0.5.x → 0.6.0) for security improvements
+- **Security advisories** will be published in the GitHub Security tab
+
+### Security Audit
+
+If you are conducting a security audit or penetration test, please contact us in advance at cevheribozoglan@gmail.com so we can coordinate and ensure your testing does not impact other users.
+
+---
+
+**Thank you for helping keep LibreDB Studio and our users safe!**
+

package/artifacthub-repo.yml

@@ -0,0 +1,4 @@
+repositoryID: 9bb770ba-de64-4168-8ab5-bfc6b4a884e9
+owners:
+  - name: cevheri
+    email: cevheribozoglan@gmail.com