For comprehensive security documentation, see SECURITY_GUIDE.md

We provide security updates for the following versions of ThreatSimGPT:

The ThreatSimGPT team takes security seriously. We appreciate your efforts to responsibly disclose your findings.

IMPORTANT: Do NOT use GitHub Issues for security vulnerabilities

Instead, please report security vulnerabilities to:

• Email: threatsimgpt@hotmail.com
• Subject: [SECURITY] ThreatSimGPT Vulnerability Report

Please include the following information in your security report:

1. Description: Clear description of the vulnerability
2. Impact: Potential impact of the vulnerability
3. Steps to Reproduce: Detailed steps to reproduce the issue
4. Proof of Concept: Code or screenshots demonstrating the issue
5. Suggested Fix: If you have ideas for fixing the issue
6. Your Information: How you'd like to be credited (optional)

• Initial Response: Within 48 hours
• Assessment: Within 1 week
• Fix Development: Depending on severity (1-4 weeks)
• Public Disclosure: After fix is released

ThreatSimGPT implements several security measures:

• Static code analysis with Bandit
• Dependency vulnerability scanning
• Automated security testing in CI/CD
• Regular dependency updates

• API key protection and rotation
• Input validation and sanitization
• Rate limiting and request throttling
• Secure environment variable handling

• Content filtering for generated material
• Educational use disclaimers
• Ethical use guidelines
• User consent and opt-out mechanisms

• Minimal data collection
• Secure storage practices
• Data retention policies
• GDPR/CCPA compliance considerations

We are particularly interested in reports of:

• Code injection vulnerabilities
• Authentication/authorization bypasses
• Sensitive data exposure
• Remote code execution
• Cross-site scripting (XSS)
• SQL injection

• Cross-site request forgery (CSRF)
• Information disclosure
• Denial of service (DoS)
• Privilege escalation
• Input validation issues

• Missing security headers
• SSL/TLS configuration issues
• Rate limiting bypasses
• Information leakage

We consider security research conducted under this policy to be:

• Authorized under the Computer Fraud and Abuse Act
• Compliant with DMCA Section 1201
• Protected activity under applicable whistleblower laws

We will not pursue legal action against security researchers who:

• Follow responsible disclosure practices
• Act in good faith
• Don't access or modify user data
• Don't disrupt services
• Don't violate privacy

We believe in recognizing security researchers who help improve ThreatSimGPT:

• Hall of Fame: Recognition in our security acknowledgments
• Credits: Listed in release notes and documentation
• Swag: ThreatSimGPT merchandise for significant findings

When security updates are released:

1. Security Advisory: Published on GitHub Security Advisories
2. Release Notes: Included in CHANGELOG.md
3. Notification: Users notified through GitHub releases
4. Documentation: Security documentation updated

To use ThreatSimGPT securely:

• Store API keys in environment variables
• Never commit API keys to version control
• Rotate API keys regularly
• Use different keys for different environments

• Review all generated content before use
• Ensure compliance with local laws and policies
• Use content only for authorized purposes
• Implement proper content filtering

• Keep ThreatSimGPT updated to latest version
• Monitor for security advisories
• Use secure hosting environments
• Implement proper access controls

• Follow secure coding practices
• Validate all inputs
• Use parameterized queries
• Implement proper error handling

ThreatSimGPT is designed to comply with:

• GDPR (General Data Protection Regulation)
• CCPA (California Consumer Privacy Act)
• SOC 2 principles
• OWASP security guidelines

For security-related questions:

• Security Email: security@threatsimgpt.com
• General Issues: GitHub Issues
• Discussions: GitHub Discussions

Note: This security policy applies only to the ThreatSimGPT codebase. For security issues with dependencies or third-party services, please report to the respective maintainers.