Currently supported versions with security updates:

We take the security of TellMeMo seriously. If you discover a security vulnerability, please follow these steps:

Please do not create a public GitHub issue for security vulnerabilities. This helps protect users until a fix is available.

Send your report to: security@tellmemo.app

Include the following information:

• Type of vulnerability
• Full path of source file(s) related to the issue
• Location of the affected code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue and potential exploits

• Initial Response: Within 48 hours
• Status Update: Within 5 business days
• Resolution Target:
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: 60 days

1. Security report received and acknowledged
2. Vulnerability confirmed and assessed
3. Fix developed and tested
4. Security advisory prepared
5. Fix released in new version
6. Public disclosure after patch available

When using TellMeMo, follow these practices:

• Never commit API keys to version control
• Use environment variables for sensitive data
• Rotate keys regularly
• Use separate keys for development and production

• Use strong passwords
• Enable SSL/TLS for database connections
• Regular backups
• Limit database user permissions

• Implement proper session management
• Use HTTPS in production
• Validate all user inputs
• Implement rate limiting

• Keep dependencies up to date
• Regularly audit for vulnerabilities
• Use flutter pub outdated and pip list --outdated
• Monitor security advisories

TellMeMo includes these security features:

• Input Validation: All user inputs are validated
• SQL Injection Prevention: Using parameterized queries
• XSS Protection: Output encoding and CSP headers
• CSRF Protection: Token-based protection
• Rate Limiting: API endpoint protection
• Secure Headers: Security headers in production

We appreciate security researchers who help keep TellMeMo secure:

This section will list security researchers who have responsibly disclosed vulnerabilities.

• Security Email: security@tellmemo.app
• PGP Key: [Available upon request]

• OWASP Top Ten
• Flutter Security Best Practices
• FastAPI Security

Thank you for helping keep TellMeMo and our users safe!