| Version | Supported |
|---|---|
| 2.0.x | ✅ Yes |
| < 2.0.0 | ❌ No |
Critical/High Severity
For critical security vulnerabilities, please contact us directly:
- Email: security@vantis.io
- PGP Key: Download
- Key ID: 0x1234567890ABCDEF
Medium/Low Severity
For non-critical issues, please use GitHub Security Advisories:
- Go to Security Advisories
- Click "Report a vulnerability"
- Provide detailed information about the issue
We offer rewards for responsible disclosure:
| Severity | Reward |
|---|---|
| Critical | $10,000 |
| High | $5,000 |
| Medium | $1,000 |
| Low | $250 |
- Always sign commits with GPG
- Use MFA for all accounts
- Never commit secrets or API keys
- Follow Zero Trust principles
- Run security audits before releases
- Keep software updated
- Use official releases only
- Verify package signatures
- Report suspicious activity
- Enable 2FA where possible
- Post-Quantum Cryptography: Kyber-1024, Dilithium
- GPG Signing: Every commit cryptographically verified
- Zero Trust Architecture: Every layer isolated
- Input Validation: All inputs sanitized
- Rate Limiting: Protection against abuse
- Audit Logging: Complete trail of actions
- Code reviewed by security team
- Automated security scans
- Dependency vulnerability checks
- Penetration testing completed
- Threat modeling done
- Security documentation updated
- Socket.dev - Package vulnerability scanning
- FOSSA - License compliance
- Dependabot - Automated dependency updates
- CodeQL - Static analysis
Remember: Security is everyone's responsibility. If you see something, say something.