Security Policy

VectorAlpha takes the security of our software products and services seriously. This includes all source code repositories managed through our GitHub organization.

Reporting Security Vulnerabilities

If you believe you have found a security vulnerability in any VectorAlpha-owned repository, please report it to us through coordinated disclosure.

What to Include

Please include as much of the following information as possible:

• Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

Response Timeline

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

We will:

1. Confirm receipt of your vulnerability report
2. Provide an estimated timeline for addressing the vulnerability
3. Notify you when the vulnerability is fixed

Disclosure Policy

We follow a coordinated disclosure model:

• We will work with you to understand and validate the reported vulnerability
• We will develop and test fixes for supported versions
• We will publicly disclose the vulnerability after patches are available
• We will credit reporters who follow coordinated disclosure (unless they prefer to remain anonymous)

Safe Harbor

VectorAlpha supports security research on our products and services under the following guidelines:

• Your research is authorized concerning our products and services
• You give us reasonable time to address vulnerabilities before public disclosure
• You do not compromise the privacy or safety of our users or their data
• You do not degrade our services or interfere with our users' experience

When conducting security research according to this policy, we consider this to be authorized conduct under the Computer Fraud and Abuse Act (CFAA), the DMCA, and other applicable laws. We will not initiate legal action against you provided you comply with this policy.

Scope

This policy applies to the following:

• All repositories under the VectorAlpha GitHub organization
• The VectorAlpha website (vectoralpha.dev)
• VectorAlpha documentation sites
• Published npm packages under @vectoralpha scope

Exclusions

The following are out of scope:

• Denial of Service (DoS) attacks
• Social engineering or phishing of VectorAlpha employees or users
• Physical attacks against VectorAlpha property or data centers
• Issues in third-party applications that integrate with VectorAlpha

Contact

For security concerns: security@vectoralpha.dev

For general inquiries: Contact Form