Skip to content

SECURITY.md

Latest commit

 

History

History
172 lines (122 loc) · 4.55 KB

SECURITY.md

File metadata and controls

172 lines (122 loc) · 4.55 KB
Raw

Security Policy

Supported Versions

This project releases frequently (roughly weekly) and does not backport fixes to older minor versions — a security fix ships in the next release, and the fix is only guaranteed against the latest published version.

Version Supported
1.4.x ✅
< 1.4 ❌ (upgrade to latest)

Reporting a Vulnerability

We take security seriously. If you discover a security vulnerability, please follow these steps:

1. DO NOT Create a Public Issue

Security vulnerabilities should never be reported via public GitHub issues, as this could put users at risk.

2. Report Privately via GitHub

Use GitHub Private Vulnerability Reporting — this opens a private draft security advisory visible only to the maintainer and GitHub, with no public disclosure until a fix is ready. This is the preferred and fastest channel.

Include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

3. What to Expect

Timeline Action
24 hours Acknowledgment of your report
3-5 days Initial assessment and severity classification
7-14 days Fix developed and tested
14-30 days Patch released and security advisory published

4. Severity Levels

Critical - Immediate attention

  • Remote code execution
  • Data leaks
  • Authentication bypass

High - Fast track (3 days)

  • Authorization bypass
  • SQL injection
  • XSS vulnerabilities

Medium - Standard track (1 week)

  • Input validation issues
  • Path traversal
  • Information disclosure

Low - Regular cycle (1 month)

  • Minor information leaks
  • DoS (local only)

Security Best Practices

Always Use HTTPS

// ✅ Good
NativeWorker.httpRequest(
  url: 'https://api.example.com/data',
)

// ❌ Bad - unencrypted
NativeWorker.httpRequest(
  url: 'http://api.example.com/data',
)

Never Log Sensitive Data

// ❌ Bad - logs credentials
print('Token: $apiToken');

// ✅ Good - redacted
if (kDebugMode) {
  print('Token: <redacted>');
}

Validate File Paths

// ✅ Good - use app directory
final appDir = await getApplicationDocumentsDirectory();
final savePath = path.join(appDir.path, 'file.zip');

NativeWorker.httpDownload(
  url: 'https://example.com/file.zip',
  savePath: savePath,
)

// ❌ Bad - arbitrary path
NativeWorker.httpDownload(
  url: 'https://example.com/file.zip',
  savePath: '/tmp/../../etc/passwd',  // Path traversal!
)

Handle Secrets Properly

// ✅ Good - use environment variables or secure storage
final apiKey = dotenv.env['API_KEY'];

// ❌ Bad - hardcoded secrets
const apiKey = 'sk_live_1234567890';  // NEVER do this!

Known Issues

Current Vulnerabilities

ID Severity Status Affected Versions
None known - - -

Fixed Vulnerabilities

ID Severity Fixed In Description
PR #44 Medium 1.3.3 RemoteTrigger HMAC signature comparison used a non-constant-time equality check, creating a timing side-channel. Fixed with MessageDigest.isEqual (Android) / HMAC.isValidAuthenticationCode (iOS).

Security Updates

Subscribe to security advisories:

Responsible Disclosure

We follow a 90-day disclosure policy:

  1. Day 0: Vulnerability reported
  2. Day 1-7: Assessment and fix development
  3. Day 7-30: Testing and patch release
  4. Day 30: Security advisory published
  5. Day 90: Full details disclosed (if not critical)

Hall of Fame

We recognize security researchers who help make native_workmanager more secure:

  • Your name could be here!

Contact

Use GitHub Private Vulnerability Reporting for anything security-sensitive — it reaches the maintainer directly and privately. For non-sensitive questions, open a GitHub Discussion or a regular issue.

Additional Resources

Last Updated: 2026-07-16