Skip to content

SECURITY.md

Latest commit

 

History

History
75 lines (48 loc) · 2.18 KB

SECURITY.md

File metadata and controls

75 lines (48 loc) · 2.18 KB

Security Policy

Supported Versions

We release patches for security vulnerabilities for the following versions:

Version Supported
0.1.x ✅

Reporting a Vulnerability

If you discover a security vulnerability, please DO NOT open a public issue.

Instead, please report it by emailing: miiitch@gmail.com

Include the following information in your report:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if you have one)

What to expect:

  1. Acknowledgment: Within 48 hours
  2. Initial assessment: Within 7 days
  3. Fix timeline: Depends on severity
    • Critical: 1-7 days
    • High: 7-14 days
    • Medium: 14-30 days
    • Low: 30-90 days
  4. Public disclosure: After fix is released

Security Best Practices

When using this project:

  1. Keep dependencies updated: Run npm audit regularly
  2. Use official releases: Don't use code from arbitrary commits
  3. Review permissions: The extension only needs MCP server access
  4. No credentials: This tool doesn't require Azure credentials (uses public pricing API)

Known Limitations

  • This tool queries the public Azure Retail Prices API (no authentication required)
  • No sensitive data is collected or stored
  • MCP server runs locally (no data sent to external servers except Azure pricing API)

Responsible Disclosure

We follow responsible disclosure practices:

  1. Security issues are fixed privately
  2. Affected users are notified
  3. Public disclosure after patch is available
  4. Credit given to reporters (if desired)

Bug Bounty

We don't currently have a bug bounty program, but we greatly appreciate security researchers who help keep our users safe.

Questions?

If you have questions about security, email: miiitch@gmail.com

Legal Notice

Microsoft, Azure, Terraform, and GitHub are trademarks of their respective owners.

This is an independent open-source project and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation, HashiCorp, Inc., or GitHub, Inc.

This tool is designed to work with Microsoft Azure services and the Terraform infrastructure-as-code tool.