We release patches for security vulnerabilities for the following versions:

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via GitHub Security Advisories:

1. Navigate to the Security Advisories page
2. Click "New draft security advisory"
3. Provide details about the vulnerability
4. We will respond within 48 hours

Please include the following information in your report:

• Type of issue (e.g., SQL injection, XSS, authentication bypass)
• Full paths of source file(s) related to the issue
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

• Initial Response: Within 48 hours
• Confirmation: Within 5 business days
• Fix Development: Timeline depends on severity
• Public Disclosure: After fix is released and users have time to update

TrueHour implements multiple layers of security:

We use automated tools to continuously scan for vulnerabilities:

• SAST: Semgrep, CodeQL for static code analysis
• SCA: Safety, Bandit, pip-audit for dependency scanning
• Container Scanning: Trivy for Docker image vulnerabilities
• Secret Scanning: Gitleaks to prevent credential leaks
• IaC Security: Hadolint, Checkov for infrastructure code

See Security CI/CD Pipeline for details.

We generate and maintain SBOMs for:

• Python backend dependencies
• API container images
• Frontend container images

SBOMs are available:

• In CycloneDX and SPDX formats
• Attached to GitHub releases
• As container image attestations

• Automated updates via Renovate
• Security patches prioritized
• Weekly review of dependency health
• Transitive dependency monitoring

• Comprehensive linting (Python, HTML, Docker)
• Type checking with mypy
• Code formatting standards (Black, isort)
• Security-focused code reviews

When contributing to TrueHour:

1. Never commit secrets

   • Use environment variables
   • Add sensitive files to .gitignore
   • Use .env.example for templates

2. Validate all inputs

   • Sanitize user input
   • Use parameterized queries
   • Validate file uploads

3. Follow secure coding practices

   • Use HTTPS for all external connections
   • Implement proper authentication/authorization
   • Handle errors securely (no sensitive data in error messages)

4. Keep dependencies updated

   • Review Renovate PRs promptly
   • Test security patches
   • Don't ignore vulnerability warnings

5. Run security checks locally

   # Before committing
   bandit -r backend/app
   safety scan --target backend/requirements.txt
   gitleaks detect --source . --verbose

1. Use strong passwords

   • Change default PostgreSQL password in production
   • Use strong, unique passwords for all services
   • Consider using a secrets manager

2. Secure your deployment

   • Use HTTPS in production
   • Enable firewall rules
   • Restrict database access
   • Regular security updates

3. Monitor security alerts

   • Review GitHub Security tab weekly
   • Subscribe to security advisories
   • Keep informed of CVEs in dependencies

4. Backup regularly

   • Regular database backups
   • Test restore procedures
   • Secure backup storage

5. Review logs

   • Monitor for suspicious activity
   • Set up alerting for anomalies
   • Retain logs for audit purposes

• Security Issues: Use GitHub Security Advisories
• General Questions: Open an issue with security label

• Security vulnerabilities are disclosed after a fix is available
• We credit security researchers (if desired)
• CVE IDs will be requested for qualifying vulnerabilities
• Public disclosure timeline: 90 days or when fix is released (whichever is sooner)

Security updates are released as soon as possible:

• Critical: Immediate patch release
• High: Within 7 days
• Medium: Next minor release
• Low: Next major release

Users are notified via:

• GitHub Security Advisories
• Release notes
• Changelog

TrueHour security practices align with:

• OWASP Top 10 (2021)
• CWE Top 25 (2023)
• NIST Cybersecurity Framework
• SBOM Standards (NTIA minimum elements)
• ISO/IEC 5962:2021 (SPDX)

We thank the security research community for responsibly disclosing vulnerabilities and helping keep TrueHour secure.

No security issues have been reported yet.

• Security Setup Guide
• Security CI/CD Documentation
• OWASP Top 10
• CWE Top 25

Last Updated: December 7, 2025 Policy Version: 1.0.0

For questions about this security policy, please open an issue with the security label.