If you discover a security vulnerability in this project, please report it privately by emailing security@rstcloud.com.

Do not open a public GitHub issue for security vulnerabilities.

Include as much of the following as possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Affected component (connector, module, configuration, Docker image)
• Suggested mitigation if you have one

You will receive an acknowledgement within 2 business days and a resolution timeline within 5 business days.

The following are in scope:

• rstmisp/ Python package (connectors, core, CLI)
• modules/ misp-modules enrichment suite
• Dockerfile and docker-compose.yml
• Configuration handling and secret management

The following are out of scope:

• Vulnerabilities in upstream dependencies (MISP, misp-stix, pymisp, rstapi) — report those to their respective projects
• Vulnerabilities requiring physical access or valid credentials to exploit
• Issues in legacy/ standalone scripts (no longer maintained)

• API keys belong in .env.rstmisp (excluded from version control via .gitignore) or passed as environment variables. Never commit credentials.
• The configs/config.php shipped in this repository contains only placeholder values. Replace them before deploying; do not commit a filled-in config.php.
• Docker images published to rstcloud/misp-connector on Docker Hub do not contain any credentials.

Only the latest release is actively supported with security fixes.