We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:

We take the security of our software seriously. If you believe you have found a security vulnerability, please report it to us as described below.

• ❌ Open a public GitHub issue
• ❌ Discuss the vulnerability in public forums
• ❌ Exploit the vulnerability

• ✅ Email us at: security@example.com
• ✅ Provide detailed information about the vulnerability
• ✅ Include steps to reproduce if possible
• ✅ Allow us reasonable time to address the issue

Please include the following information:

1. Description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact of the vulnerability
4. Affected versions
5. Suggested fix (if you have one)
6. Your contact information for follow-up

Subject: [SECURITY] Potential Command Injection in install-kiro.sh

Description:
There appears to be a command injection vulnerability in the install-kiro.sh 
script at line 123 where user input is not properly sanitized.

Steps to Reproduce:
1. Run: ./install-kiro.sh --custom-path "$(malicious_command)"
2. The malicious command gets executed

Impact:
An attacker could execute arbitrary commands with the privileges of the 
user running the script.

Affected Versions:
- Version 1.0.0
- Version 0.9.0

Suggested Fix:
Properly sanitize user input using parameter expansion and validation.

Contact:
researcher@example.com

When using our installers:

1. Verify the source: Always download from official repositories
2. Check signatures: Verify script integrity when possible
3. Review scripts: Inspect scripts before running with elevated privileges
4. Use --user flag: Install without sudo when possible
5. Keep updated: Use the latest version

1. Input validation: Always validate and sanitize user input
2. Avoid eval: Never use eval with user-provided data
3. Quote variables: Always quote variables to prevent injection
4. Least privilege: Request minimal permissions necessary
5. Secure downloads: Use HTTPS for all downloads
6. Verify checksums: Validate downloaded files when possible

Our installers include several security features:

• ✅ No automatic sudo: Scripts ask for permission before using sudo
• ✅ User-only mode: Option to install without elevated privileges
• ✅ Input validation: All user inputs are validated
• ✅ Secure downloads: HTTPS-only downloads
• ✅ Temporary files: Proper cleanup of temporary files
• ✅ Configuration backup: Automatic backup before updates

Before each release, we verify:

• All user inputs are validated
• No use of eval with user data
• All variables are properly quoted
• Downloads use HTTPS
• Temporary files are cleaned up
• No hardcoded credentials
• Proper permission checks
• Error messages don't leak sensitive info
• ShellCheck passes with no warnings
• Security review completed

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-7 days
  • High: 7-30 days
  • Medium: 30-90 days
  • Low: Next release cycle

We appreciate security researchers who help keep our project safe. With your permission, we'll acknowledge your contribution in:

• Security advisories
• Release notes
• Hall of Fame (coming soon)

• OWASP Secure Coding Practices
• Bash Security Best Practices
• CWE - Common Weakness Enumeration

• Security Email: security@example.com
• PGP Key: [Link to PGP key]
• Response Time: 48 hours

Thank you for helping keep our project and our users safe! 🙏