Skip to content

Security: Hack23/game

Security

Report a vulnerability

SECURITY.md

Hack23 AB Logo

🔐 Hack23 AB — Game Template Security Policy

🛡️ Security Through Transparency and Excellence
🎯 Security-first game development with verifiable compliance

Owner Version Effective Date Review Cycle

📋 Document Owner: CEO | 📄 Version: 1.0 | 📅 Last Updated: 2025-11-10 (UTC)
🔄 Review Cycle: Quarterly | ⏰ Next Review: 2026-02-10

🎯 Security Commitment

At Hack23 AB, we are committed to maintaining the highest standards of security in all our projects. This game template implements comprehensive security measures aligned with our Information Security Management System (ISMS), providing verifiable transparency and demonstrating security excellence.

📋 ISMS Policy Framework

All security practices in this repository are governed by our publicly available ISMS policies:

🔐 Core Security Policies

Policy Purpose Link
🔐 Information Security Policy Overarching security governance and principles View Policy
🛠️ Secure Development Policy SDLC, testing, deployment, and CI/CD requirements View Policy
📦 Open Source Policy Open source usage, license compliance, supply chain security View Policy
🏷️ Data Classification Policy Data sensitivity levels, handling requirements View Policy
🔒 Privacy Policy Personal data protection, GDPR compliance View Policy
🔑 Access Control Policy Authentication, authorization, identity management View Policy

📊 Complete Feature Mapping

For a comprehensive mapping of game template features to ISMS policies, see our ISMS Policy Mapping document.

✅ Supported Versions

This project is under active development, and we provide security updates for the latest version only. Please ensure you're using the latest version of the project to receive security updates.

Version Supported
latest ✅

🛡️ Security Features & Evidence

This template implements comprehensive security measures aligned with our Secure Development Policy and Open Source Policy:

🔍 Static & Dynamic Analysis

📦 Supply Chain Security

  • 🏆 OSSF Scorecard - Supply chain security assessment

  • 🔍 Dependency Review - Automated dependency vulnerability checks

  • 📜 License Compliance - Automated license checking

    • Policy: Open Source Policy
    • Approved Licenses: MIT, Apache-2.0, BSD variants, ISC, CC0-1.0, Unlicense
    • Command: npm run test:licenses

  • 📄 SBOM Generation - Software Bill of Materials in SPDX format

  • 📊 SBOM Quality Validation - Automated quality scoring with SBOMQS

  • 🏷️ Pinned Dependencies - All GitHub Actions pinned to SHA hashes

🔏 Build Integrity & Attestations

  • 🔐 SLSA Provenance - Build attestations for artifact verification

  • 🛡️ Immutable Releases - Release artifacts cannot be tampered with

  • 🔏 Artifact Signing - Cryptographic proof of build integrity

🧪 Testing & Quality Assurance

🔐 Security Infrastructure

  • 🔒 Runner Hardening - All CI/CD runners hardened with audit logging

  • 🚨 Security Advisories - Private vulnerability disclosure

👥 Secure Development Environment

🚨 Reporting a Vulnerability

We take the security of the game template project seriously. If you have found a potential security vulnerability, we kindly ask you to report it privately, so that we can assess and address the issue before it becomes publicly known.

Our vulnerability management process is governed by our Information Security Policy and follows industry best practices for responsible disclosure.

🔍 What Constitutes a Vulnerability

A vulnerability is a weakness or flaw in the project that can be exploited to compromise the security, integrity, or availability of the system or its data. Examples of vulnerabilities include, but are not limited to:

  • Unauthenticated access to sensitive data
  • Injection attacks (e.g., SQL injection, cross-site scripting)
  • Insecure defaults or configurations
  • Insufficient access controls
  • Remote code execution

🛡️ How to Privately Report a Vulnerability using GitHub

Please follow these steps to privately report a security vulnerability:

  1. On GitHub.com, navigate to the main page of the game repository.
  2. Under the repository name, click Security. If you cannot see the "Security" tab, select the dropdown menu, and then click Security.
  3. In the left sidebar, under "Reporting", click Advisories.
  4. Click Report a vulnerability to open the advisory form.
  5. Fill in the advisory details form. Provide as much information as possible to help us understand and reproduce the issue.
  6. At the bottom of the form, click Submit report.

After you submit the report, the maintainers of the game repository will be notified. They will review the report, validate the vulnerability, and take necessary actions to address the issue. You will be added as a collaborator and credited for the security advisory.

⏱️ Disclosure Timeline

Upon receipt of a vulnerability report, our team will:

  1. Acknowledge the report within 48 hours
  2. Validate the vulnerability within 7 days
  3. Develop and release a patch or mitigation within 30 days, depending on the complexity and severity of the issue
  4. Publish a security advisory with a detailed description of the vulnerability and the fix

🏆 Recognition and Anonymity

We appreciate your effort in helping us maintain a secure and reliable project. If your report results in a confirmed security fix, we will recognize your contribution in the release notes and/or a public acknowledgment, unless you request to remain anonymous.

📚 Related Security Resources

Internal Documentation

ISMS-PUBLIC Policies

All security practices are governed by our publicly available ISMS:

📚 Related Documents

📋 Document Control:
✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification: Confidentiality: Public
📅 Effective Date: 2025-11-10
⏰ Next Review: 2026-02-10
🎯 Framework Compliance: ISO 27001 NIST CSF 2.0 CIS Controls AWS Well-Architected

Thank you for helping us keep the game project and its users safe.

Part of Hack23 AB's commitment to transparency and security excellence

There aren’t any published security advisories