We take the security of SkyFlow seriously. If you discover a security vulnerability, please follow these steps:

Please do not open a GitHub issue for security vulnerabilities, as this could expose the vulnerability to malicious actors.

Send a detailed report to the maintainer via:

• GitHub: Open a private security advisory via the "Security" tab of this repository
• Email: Contact the repository owner directly

• A description of the vulnerability
• Steps to reproduce the issue
• Potential impact of the vulnerability
• Any suggested fixes (optional but appreciated)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution: Depends on complexity, typically within 30 days

When contributing to SkyFlow, please ensure:

1. Never commit sensitive data (passwords, API keys, tokens, connection strings) to the repository
2. Validate all user input before processing to prevent injection attacks
3. Use parameterised SQL for all database queries (no string concatenation)
4. Use exception handling for all I/O and database operations
5. Do not hardcode credentials or configuration values in source code
6. Hash all passwords using BCrypt before storage
7. Handle thread safety carefully when working with shared resources

SkyFlow implements the following security measures:

• ✅ BCrypt password hashing for all user credentials
• ✅ Parameterised SQL queries preventing SQL injection
• ✅ Input validation for all user-facing fields
• ✅ Role-based access control preventing unauthorized actions
• ✅ Connection string stored in configuration, not source code
• ✅ Graceful error handling for invalid input types

We appreciate security researchers who responsibly disclose vulnerabilities. Contributors who report valid security issues will be acknowledged in our release notes (with permission).