PolicySECURITY POLICY
How to report vulnerabilities in SOVA, our response process, and the scope of what we consider a security issue.
Security patches are only released for currently supported versions.
REPORTING A VULNERABILITY
CRITICAL
Email [email protected] to report security vulnerabilities. Do NOT use public GitHub issues for security reports.
What to include in your report:
- •Description of the vulnerability
- •Steps to reproduce
- •Impact assessment
- •Any suggested fixes (optional)
Our commitment to timely communication after receiving a vulnerability report.
48 hours
Acknowledgment of receipt
5 business days
Communication of fix timeline
Coordinated disclosure
We will coordinate with you on public disclosure
SCOPE
What qualifies as a security issue in SOVA:
- 1Path traversal in directory walking (symlink following, escape from project root)
- 2Unsafe parsing of XML, YAML, TOML, or JSON (XXE, billion laughs, prototype pollution)
- 3ReDoS in signal detection regex patterns
- 4Data leakage in manifest output (accidental inclusion of file contents, env vars, secrets)
- 5Vulnerabilities in SOVA’s own npm dependencies
