| Service Name | Supported |
|---|---|
| ws-gateway-service | ✅ |
| ws-web-attack-detection | ✅ |
| ws-common-attack-detection | ✅ |
We take the security of our systems and services seriously. If you discover a vulnerability, please report it to us as soon as possible using GitHub's Report a Vulnerability feature.
- Go to the Security tab of this repository.
- Click on Report a Vulnerability.
- Fill out the vulnerability report form with the following details:
- Title: Use the format:
[Vulnerability Report] Whale Sentinel - <Service Name> - <Brief Description>. - Description of the vulnerability.
- Steps to reproduce the issue.
- Potential impact of the vulnerability.
- Any proof-of-concept or screenshots (if applicable).
- Your contact information (optional).
- Title: Use the format:
- Acknowledgement: You will receive an acknowledgment of your report within 1 business day.
- Assessment: Our security team will assess the vulnerability and determine its severity using the Common Vulnerability Scoring System (CVSS).
- Updates: We will provide regular updates on the status of the vulnerability and the expected timeline for resolution.
- Resolution: Once the issue is resolved, we will notify you and, if applicable, publicly acknowledge your contribution (with your consent).
We use the Common Vulnerability Scoring System (CVSS) Version 4.0 to assess and prioritize vulnerabilities. Below are our response and resolution timelines based on severity:
| Severity | CVSS Score Range | Time to Fix |
|---|---|---|
| None | 0.0 | N/A |
| Low | 0.1 - 3.9 | Within 6 months |
| Medium | 4.0 - 6.9 | Within 3 months |
| High | 7.0 - 8.9 | Within 1 week |
| Critical | 9.0 - 10.0 | Within 3 days |
- Public Disclosure: Vulnerabilities will be disclosed publicly only after they have been resolved and verified. We will credit the reporter (if desired) and provide details of the fix.
- Embargo Period: For critical vulnerabilities, we may request an embargo period to ensure all users have sufficient time to apply patches before public disclosure.
To help us maintain a secure environment, we encourage the following:
- Regularly update and patch all systems and dependencies.
- Use strong, unique passwords and enable multi-factor authentication (MFA) where possible.
- Monitor and log access to sensitive systems and data.
- Conduct regular security audits and penetration testing.
For any security-related questions or concerns, please contact our security team at t.me/noobpk.