Skip to content

Security Policy

Supported Versions

We actively support the following versions of Vyte with security updates:

Version Supported
2.0.x ✅
\< 2.0 ❌

Reporting a Vulnerability

We take security vulnerabilities seriously. If you discover a security issue in Vyte, please report it responsibly.

🔒 Private Disclosure

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via one of these methods:

  1. Email: Send details to Domi@usal.es

  2. Subject: [SECURITY] Vyte Vulnerability Report

  3. Include detailed description of the vulnerability
  4. Steps to reproduce
  5. Potential impact assessment

  6. Suggested fix (if any)

  7. GitHub Security Advisory: Use GitHub's private vulnerability reporting

⏱️ Response Timeline

  • Initial Response: Within 48 hours
  • Status Update: Within 5 business days
  • Fix Timeline: Depends on severity
  • Critical: Within 7 days
  • High: Within 14 days
  • Medium: Within 30 days
  • Low: Next regular release

📋 What to Include

Please include as much information as possible:

  1. Type of vulnerability (e.g., code injection, path traversal, etc.)
  2. Full paths of source files related to the vulnerability
  3. Location of the affected source code (tag/branch/commit)
  4. Step-by-step instructions to reproduce the issue
  5. Proof-of-concept or exploit code (if possible)
  6. Impact of the vulnerability
  7. Possible mitigation or workarounds

🎖️ Vulnerability Disclosure Process

  1. Report Received: We acknowledge receipt of your vulnerability report
  2. Investigation: We investigate and validate the vulnerability
  3. Fix Development: We develop and test a fix
  4. Notification: We notify you when the fix is ready
  5. Release: We release a patch and security advisory
  6. Recognition: We credit you in the security advisory (unless you prefer to remain anonymous)

🏆 Security Researcher Recognition

We appreciate security researchers who help keep Vyte secure. With your permission, we will:

  • Credit you in the security advisory
  • Mention you in the release notes
  • Add you to our security hall of fame (if we create one)

🛡️ Security Best Practices for Users

Generated Projects

When using Vyte to generate projects:

  1. Environment Variables:

  2. Never commit .env files to version control

  3. Use strong, unique values for JWT_SECRET_KEY

  4. Rotate secrets regularly

  5. Dependencies:

  6. Keep dependencies updated

  7. Run pip-audit or safety check regularly

  8. Review generated requirements.txt

  9. Database Credentials:

  10. Use strong passwords

  11. Never use default credentials in production

  12. Use environment variables for database URLs

  13. JWT Tokens:

  14. Use strong secret keys (minimum 32 characters)

  15. Set appropriate expiration times

  16. Implement token refresh mechanisms

  17. Docker:

  18. Don't run containers as root

  19. Scan images for vulnerabilities
  20. Keep base images updated

Vyte CLI

When using Vyte CLI:

  1. Installation:

  2. Install from official sources (PyPI)

  3. Verify package signatures if available

  4. Use virtual environments

  5. Project Generation:

  6. Review generated code before deployment

  7. Customize security settings for your needs
  8. Remove unused features to reduce attack surface

🔐 Known Security Considerations

Template Injection

Vyte uses Jinja2 for templating. We have taken precautions to prevent template injection:

  • Templates are bundled with the package
  • User input is sanitized before template rendering
  • No user-provided templates are executed

Path Traversal

Project names and paths are validated to prevent path traversal attacks:

  • Restricted character sets for project names
  • Absolute path resolution
  • Validation before file operations

Dependency Security

We regularly monitor and update dependencies to address known vulnerabilities.

Generated projects include:

  • Latest stable versions of frameworks
  • Security-focused defaults
  • Dependency pinning for reproducibility

📚 Security Resources

For Generated Projects

Tools for Security Scanning

# Python dependency vulnerabilities
pip install pip-audit
pip-audit

# Alternative
pip install safety
safety check

# Code security analysis
pip install bandit
bandit -r src/

# Secret scanning
pip install detect-secrets
detect-secrets scan

🔄 Security Updates

Subscribe to security updates:

  1. GitHub: Watch the repository for security advisories
  2. PyPI: Monitor package updates
  3. Email: Contact us to join security mailing list

❓ Questions?

If you have questions about:

  • This security policy
  • Security features in Vyte
  • Security best practices for generated projects

Please contact: Domi@usal.es

Note: This security policy applies to the Vyte CLI tool itself. Generated projects should establish their own security policies based on their specific requirements.

Thank you for helping keep Vyte and its users safe! 🛡️