Skip to content

SECURITY.md

Latest commit

 

History

History
65 lines (42 loc) · 1.41 KB

SECURITY.md

File metadata and controls

65 lines (42 loc) · 1.41 KB

Security Policy

Supported Versions

Currently only the latest version is supported.

Reporting a Vulnerability

If you discover a security vulnerability, please send an email to security@lattice.db.

Please include:

  1. Description of the vulnerability
  2. Steps to reproduce
  3. Potential impact
  4. Suggested fix (if known)

Response Timeline

  • Initial Response: Within 48 hours
  • Detailed Response: Within 7 days
  • Fix Release: As appropriate

Disclosure Policy

Vulnerabilities are disclosed after a fix is released.

Security Best Practices

For Users

  1. Enable Encryption: Always use database encryption
  2. Secure Keys: Store keys securely (keychain, TPM)
  3. Verify Sync: Use known sync servers or self-host
  4. Backup: Regular encrypted backups

For Server Operators

  1. TLS Required: Always use HTTPS/WSS
  2. Rate Limiting: Prevent abuse
  3. Monitoring: Log and monitor for suspicious activity
  4. Updates: Keep server updated

Encryption Configuration

Recommended Settings

  • Algorithm: AES-256-GCM
  • Key Size: 256 bits
  • KDF: Argon2id with appropriate parameters
  • Signature: Ed25519

Key Rotation

  1. Generate new key pair
  2. Re-encrypt data with new key
  3. Update all devices
  4. Archive old key securely
  5. Delete old key after verification

Audit

This document will be updated as the security landscape evolves.

Last updated: 2025-01-03