# Security Policy

## Supported Versions

We release patches for security vulnerabilities in the following versions:

| Version | Supported          |
| ------- | ------------------ |
| 0.0.8   | :white_check_mark: |
| 0.0.7   | :white_check_mark: |
| 0.0.6   | :x:                |
| < 0.0.6 | :x:                |

## Reporting a Vulnerability

We take the security of Face Detection TADI SDK seriously. If you discover a security vulnerability, please follow these steps:

### Where to Report

**DO NOT** create a public GitHub issue for security vulnerabilities.

Instead, please report security vulnerabilities to:
- **Email**: security@tadi.uz
- **Subject**: [SECURITY] Face Detection SDK - Brief Description

### What to Include

When reporting a vulnerability, please include:

1. **Description**: A clear description of the vulnerability
2. **Impact**: What could an attacker achieve by exploiting this vulnerability
3. **Steps to Reproduce**: Detailed steps to reproduce the issue
4. **Affected Versions**: Which versions of the SDK are affected
5. **Proposed Solution**: If you have suggestions for fixing the issue
6. **Your Contact**: How we can reach you for follow-up questions

### Example Report

```
Subject: [SECURITY] Face Detection SDK - JWT Validation Bypass

Description:
The JWT signature validation can be bypassed by...

Impact:
An attacker could forge authentication tokens and...

Steps to Reproduce:
1. Create a JWT with...
2. Send request to...
3. Observe that...

Affected Versions:
0.0.1 - 0.0.7

Proposed Solution:
Add additional validation for...

Contact:
john.doe@example.com
```

## Response Timeline

- **Acknowledgment**: We will acknowledge receipt within 48 hours
- **Initial Assessment**: We will provide an initial assessment within 5 business days
- **Status Updates**: We will keep you informed of our progress
- **Resolution**: We aim to release a patch within 30 days for critical vulnerabilities

## Disclosure Policy

- We follow a **coordinated disclosure** approach
- We will notify you before public disclosure
- We will credit you in the security advisory (unless you prefer to remain anonymous)
- Please allow us time to fix the vulnerability before public disclosure

## Security Best Practices for Users

### Access Token Management
- Never hardcode access tokens in your application
- Use secure storage solutions (e.g., `flutter_secure_storage`)
- Rotate tokens regularly
- Use environment-specific tokens (dev, staging, production)

### Certificate Management
- Store client certificates securely
- Never commit certificates to version control
- Use secure key management services in production
- Implement certificate rotation policies

### Network Security
- Always use HTTPS in production
- Enable mutual SSL/TLS for sensitive operations
- Validate SSL certificates
- Implement certificate pinning for critical applications

### Data Protection
- Handle biometric data according to GDPR/local regulations
- Implement data retention policies
- Encrypt sensitive data at rest
- Clear sensitive data from memory after use

### Code Security
```dart
// ✅ Good: Secure token storage
final secureStorage = FlutterSecureStorage();
final token = await secureStorage.read(key: 'api_token');

// ❌ Bad: Hardcoded token
final token = 'hardcoded_token_123';

// ✅ Good: Use environment variables
final config = SdkConfig(
  accessToken: const String.fromEnvironment('TADI_TOKEN'),
);

// ❌ Bad: Token in source code
final config = SdkConfig(
  accessToken: 'my-secret-token',
);
```

### Dependency Management
- Keep the SDK updated to the latest version
- Regularly check for security updates
- Review dependency vulnerabilities
- Use `flutter pub outdated` regularly

### Testing Security
- Never use production credentials in tests
- Use mock servers for testing
- Implement security testing in CI/CD
- Perform regular security audits

## Known Security Considerations

### Root/Jailbreak Detection
The SDK includes root/jailbreak detection at the native level. However:
- This is not foolproof and can be bypassed by sophisticated attackers
- Use additional server-side validation for critical operations
- Consider implementing additional security measures for high-risk scenarios

### Biometric Data
- All biometric data is transmitted securely via HTTPS
- Face captures are Base64 encoded
- Data is processed according to the configured privacy policy
- Implement proper user consent mechanisms

### JWT Validation
- Enable JWT validation for production environments
- Use RSA keys (minimum 2048-bit) for production
- Rotate signing keys regularly
- Implement proper key management

## Security Updates

Subscribe to security updates:
- Watch this repository for security advisories
- Follow our security mailing list (coming soon)
- Check CHANGELOG.md for security-related updates

## Compliance

This SDK is designed to support compliance with:
- GDPR (General Data Protection Regulation)
- PCI DSS (for payment-related use cases)
- SOC 2 requirements
- Local biometric data regulations

**Note**: Compliance implementation is the responsibility of the integrating application.

## Bug Bounty Program

We are currently working on establishing a bug bounty program. Details will be announced soon.

## Questions?

For security-related questions that don't require immediate attention:
- Email: security@tadi.uz
- General Support: support@tadi.uz

---

**Last Updated**: January 10, 2026
**Version**: 1.0
