Security updates are applied to the active deployment branch.
| Version | Supported |
|---|---|
| 2.0.x | ✅ |
| < 2.0 | ❌ |
We take the security of SatyaSetu seriously. If you discover a security vulnerability, please report it responsibly:
- Do not disclose the vulnerability publicly via GitHub Issues or public pull requests.
- Please report the issue privately to the maintainers or via repository private vulnerability reporting.
- Include detailed steps to reproduce the vulnerability, including:
- Specific endpoint or module affected.
- Sample payload or request reproducing the behavior.
- Impact assessment.
Maintainers will acknowledge receipt within 48 hours and work on an expedited patch.
- Rate Limiting: Dual-layer rate limiting (per-IP sliding window and per-hashed sender window) to prevent denial of service and abuse.
- SSRF Protection: Private IP, loopback, and cloud metadata request guards on all external media fetchers.
- PII Minimization: End-user phone numbers are salted and hashed via HMAC-SHA256. Raw verbatim user messages are never persisted to disk.
- Constant-Time Verification: Administrative endpoints use
secrets.compare_digestto mitigate timing attack vectors.