FlowOS takes security seriously. This document describes how security vulnerabilities are handled and how they should be reported.

Security updates are only provided for the latest stable release. Pre-release versions (*alpha*, *beta*, *rc*) are not eligible for security fixes.

Do not open a public issue. Please report security vulnerabilities privately to the maintainers at:

• Email: yasserameur.dev@gmail.com

Please include the following details:

1. The affected version(s) and, if possible, the commit hash.
2. A description of the vulnerability and its impact.
3. A minimal, reproducible example or proof of concept.
4. Any mitigations you have already applied.

You should receive an acknowledgment within 72 hours. We ask that you allow a reasonable coordinated-disclosure window (default 90 days) before disclosing publicly, so that a fix can be released.

• Do not access or modify data you do not own while verifying a vulnerability.
• Do not run vulnerability scanners against production instances.
• Do not publicly disclose the issue before a fix is released.

In scope:

• The FlowOS backend (backend/) and SDK (sdk/).
• The FlowOS frontend (frontend/).
• Official Docker images and the docker-compose deployment.

Out of scope:

• Dependencies already covered by their own disclosure processes.
• Third-party plugin nodes (report them to the plugin author).
• Infrastructure configured by the user outside FlowOS's control.

The following areas receive the highest scrutiny in review:

• Authentication and authorization (JWT, OAuth2, refresh tokens, RBAC).
• Credential and secret storage (Fernet encryption, key management).
• Expression and template evaluation (must never use unsafe eval).
• Webhook endpoints and inbound payload validation.
• Rate limiting and abuse protection.
• Audit logging completeness.

• Credential secrets are encrypted at rest with Fernet; keys are never logged.
• Passwords are hashed with Argon2.
• All input is validated at the API boundary and in the domain layer.
• Dependencies are pinned and monitored for known vulnerabilities.
• We use the security label and dependabot alerts to track issues.

Acknowledgment: 72 hours.

Resolution target: 90 days for coordinated disclosure.