We take the security of Ariane seriously. This document outlines our security practices and how to report security vulnerabilities.

We provide security updates for the following versions:

If you discover a security vulnerability, please follow these steps:

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

1. Go to the Security tab of this repository
2. Click “Report a vulnerability”
3. Fill out the vulnerability report form with:
   • Description: Clear description of the vulnerability
   • Steps to reproduce: Detailed steps to reproduce the issue
   • Impact: Potential impact and severity
   • Affected components: Which parts of the system are affected
   • Suggested fix: If you have ideas for how to fix it

If GitHub Security Advisories is not available, you can report via:

• Email: Create an issue with the [SECURITY] prefix
• Contact: Reach out through the repository’s contact methods

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution Timeline: Depends on severity
  • Critical: 24-72 hours
  • High: 1-2 weeks
  • Medium: 2-4 weeks
  • Low: Best effort

We’re particularly interested in vulnerabilities related to:

• Authentication bypass
• Privilege escalation
• Session management issues
• OAuth/OIDC vulnerabilities

• SQL injection
• NoSQL injection
• Data exposure
• Sensitive data leakage

• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Server-Side Request Forgery (SSRF)
• Path traversal
• File upload vulnerabilities

• Container security issues
• Dependency vulnerabilities
• Configuration security
• Secrets exposure

• API authentication/authorization flaws
• Rate limiting bypass
• Input validation issues
• Information disclosure

We believe in recognizing security researchers who help improve our security:

• Public Recognition: With permission, we’ll acknowledge your contribution
• CVE Assignment: For qualifying vulnerabilities
• Security Advisory: We’ll publish advisories for significant issues

• CodeQL Analysis: Continuous code scanning
• Dependency Scanning: Automated vulnerability detection
• Secret Scanning: Prevention of credential exposure
• SAST/DAST: Static and dynamic analysis

• Regular Updates: Dependencies and security patches
• Code Review: All changes reviewed for security
• Least Privilege: Minimal access principles
• Encryption: Data at rest and in transit

• Security Monitoring: Continuous security monitoring
• Incident Response: Defined response procedures
• Regular Audits: Periodic security assessments

• Authentication Guide
• API Security
• Deployment Security

• WebAuthn: Passwordless authentication
• Zitadel: Identity and access management
• CSP Headers: Content Security Policy
• Security Headers: Comprehensive protection

For security-related questions or concerns:

• GitHub: Use repository issues with [SECURITY] prefix
• Maintainer: @WenzelArifiandi
• Security Team: Available via GitHub discussions

• We follow responsible disclosure practices
• We’ll work with researchers to understand and fix issues
• We’ll coordinate on public disclosure timing

• Security advisories published after fixes
• CVE assignment for qualifying vulnerabilities
• Credit given to researchers (with permission)

• We will not pursue legal action against researchers who:
  • Follow this security policy
  • Act in good faith
  • Do not harm users or systems
  • Do not access/modify/delete data without permission

This security policy may be updated periodically. Please check back regularly for the latest version.

Last Updated: September 2025 Version: 1.0 Contact: GitHub Issues

Generated build artifacts (for example studio/dist, site/dist, Astro’s _astro) are excluded from security analysis. Code scanning alerts on these files are non-actionable and may be dismissed.

To bulk-dismiss non-actionable alerts:

• OSSF Scorecard alerts (repository health metrics) should be dismissed from Code Scanning.
• Alerts pointing at generated files in studio/dist/ and site/dist/ should be dismissed.

Automate this cleanup with:

scripts/dismiss-code-scanning-alerts.sh

Requirements: GitHub CLI (gh) authenticated with permissions to manage code scanning alerts.