• Supported Versions
• Reporting a Vulnerability
• Security Measures
• Security Best Practices
• Automated Security
• Known Security Issues
• Security Update Process
• Security Contacts

We release security updates for the following versions:

Recommendation: Always use the latest stable version for the best security and features.

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

• ❌ Open a public GitHub issue
• ❌ Discuss the vulnerability publicly
• ❌ Exploit the vulnerability
• ❌ Share the vulnerability with others

1. Email us privately: Send details to security@thisjowi.uk
2. Provide details: Include a description, steps to reproduce, and potential impact
3. Wait for confirmation: We'll acknowledge receipt within 48 hours
4. Coordinate disclosure: We'll work with you on responsible disclosure

Subject: [SECURITY] Brief description of vulnerability

Description:
[Detailed description of the vulnerability]

Affected Component:
[Which part of the application is affected]

Steps to Reproduce:
1. [Step 1]
2. [Step 2]
3. [Step 3]

Expected Behavior:
[What should happen]

Actual Behavior:
[What actually happens]

Impact:
[Potential security impact]

Suggested Fix (optional):
[Your suggestions for fixing the issue]

Environment:
- App Version: [version]
- Platform: [Android/iOS/Web/etc.]
- OS Version: [version]

Your Contact:
- Name: [Your name]
- Email: [Your email]
- GitHub: [Your GitHub username]

We classify vulnerabilities using CVSS scoring:

• 🔴 Critical (9.0-10.0): Immediate action required
• 🟠 High (7.0-8.9): Urgent attention needed
• 🟡 Medium (4.0-6.9): Should be addressed soon
• 🟢 Low (0.1-3.9): Can be addressed in regular updates

• ✅ JWT token-based authentication
• ✅ Secure token storage using platform-specific secure storage
• ✅ Automatic token refresh
• ✅ Session timeout management
• ✅ Biometric authentication support (iOS/macOS)

// Token storage example
import 'package:flutter_secure_storage/flutter_secure_storage';

final storage = FlutterSecureStorage();
await storage.write(key: 'jwt_token', value: token);

• ✅ HTTPS-only communication
• ✅ SSL certificate pinning (planned)
• ✅ Encrypted local storage for sensitive data
• ✅ No sensitive data in logs
• ✅ Input validation and sanitization

• ✅ API timeout configuration
• ✅ Request/response interceptors
• ✅ Error handling without exposing internals
• ✅ Rate limiting (backend-side)

// Secure API configuration
class ApiConfig {
  static const int requestTimeout = 15;
  static Map<String, String> authHeaders(String token) => {
    'Authorization': 'Bearer $token',
    'Content-Type': 'application/json',
  };
}

• ✅ Environment variables for configuration
• ✅ No hardcoded secrets
• ✅ .env file in .gitignore
• ✅ Separate configs for dev/prod

• ✅ No sensitive data in code
• ✅ Obfuscation for release builds
• ✅ ProGuard/R8 enabled (Android)
• ✅ Code signing (iOS/Android)

• 🔒 Use strong, unique passwords
• 🔑 Enable biometric authentication if available
• 📱 Keep the app updated
• 🚫 Don't share your credentials
• ⚠️ Be cautious of phishing attempts
• 🔄 Regularly review your account activity

• 🔒 Use device lock screen (PIN/Pattern/Biometric)
• 🔄 Keep your OS updated
• 🚫 Don't root/jailbreak your device
• 📱 Install apps only from official stores
• 🔍 Review app permissions

# ✅ DO: Use environment variables
LOCAL_NETWORK_IP=192.168.1.100
API_KEY=get_from_secure_storage

# ❌ DON'T: Hardcode sensitive data
final apiKey = "sk_live_12345abcdef"; // NEVER DO THIS!

• No API keys or secrets in code
• No sensitive data in logs
• Input validation implemented
• Error messages don't expose internals
• HTTPS used for all API calls
• Proper authentication checks
• Secure data storage used
• Dependencies are up to date
• Security tests pass

✅ Good: Secure password handling

Future<void> login(String email, String password) async {
  try {
    final response = await authService.login(email, password);
    await secureStorage.write(key: 'token', value: response.token);
    // Password is not stored or logged
  } catch (e) {
    // Generic error message, no sensitive details
    throw AuthException('Authentication failed');
  }
}

❌ Bad: Insecure password handling

Future<void> login(String email, String password) async {
  print('Password: $password'); // DON'T LOG PASSWORDS!
  prefs.setString('password', password); // DON'T STORE PASSWORDS!
  
  try {
    final response = await authService.login(email, password);
  } catch (e) {
    print('Error: $e'); // Might expose sensitive details
  }
}

We run automated security scans on every push and pull request:

• Dependency vulnerability scanning
• Static code analysis
• Secret detection in code
• Android security linting

Runs: Push to main/develop, PRs, Weekly schedule

• Detects exposed .env files
• Finds hardcoded IPs
• Identifies API key patterns
• Checks for Android keystores
• Validates Firebase configs

Runs: Push to main/develop, PRs

# Run security checks locally
flutter analyze
flutter test --coverage

# Check for outdated/vulnerable packages
flutter pub outdated

We regularly update dependencies to patch security vulnerabilities:

# Check for security updates
flutter pub outdated --mode=null-safety

# Update dependencies
flutter pub upgrade

# Verify app still works
flutter test
flutter run

See Security Advisories for complete history.

1. Triage (24-48 hours)

   • Assess severity
   • Verify reproducibility
   • Determine impact

2. Development (1-30 days depending on severity)

   • Develop fix
   • Write tests
   • Code review

3. Testing (3-7 days)

   • Security testing
   • Regression testing
   • QA verification

4. Release (ASAP for critical issues)

   • Patch release
   • Release notes
   • Security advisory

5. Disclosure (Coordinated)

   • Public announcement
   • CVE assignment (if applicable)
   • Credit to reporter

For critical security issues:

• 📧 Email notification to users
• 📱 In-app notification
• 📢 Blog post/announcement
• 🔔 GitHub security advisory

We regularly assess our security posture:

• Code review process in place
• Automated security scanning enabled
• Dependency updates automated
• Secrets management implemented
• Incident response plan documented
• Third-party security audit (planned)
• Penetration testing (planned)

• Last Audit: November 2025 (Internal)
• Next Audit: Q2 2026 (External)
• Audit Reports: Available upon request

• 📧 Email: security@thisjowi.uk
• 🔒 PGP Key: [Available on request]
• ⏰ Response Time: Within 48 hours

For critical, actively exploited vulnerabilities:

• 📧 Email: security-urgent@thisjowi.uk
• 📱 Response Time: Within 4 hours

• OWASP Mobile Security
• Flutter Security Best Practices
• Dart Security
• NIST Mobile Security Guidelines

We encourage contributors to:

• Complete OWASP Mobile Security training
• Stay updated on Flutter security advisories
• Review CVE databases regularly

We're planning to launch a bug bounty program. Details will be announced in Q1 2026.

Interested? Email security@thisjowi.uk to be notified when we launch.

• Protocol: TLS 1.2 or higher
• Cipher Suites: Modern, secure ciphers only
• Certificate Validation: Enabled and enforced

• Platform Storage: iOS Keychain, Android Keystore
• Encryption: AES-256 where available
• Key Management: Platform-managed secure enclaves

We strive to comply with:

• ✅ GDPR (General Data Protection Regulation)
• ✅ CCPA (California Consumer Privacy Act)
• ✅ OWASP Mobile Top 10
• ✅ NIST Cybersecurity Framework

See our Privacy Policy for details on data handling.

We support responsible disclosure of security vulnerabilities. Reporters who follow our guidelines will be:

• ✅ Credited in security advisories (unless anonymity requested)
• ✅ Kept informed throughout the fix process
• ✅ Thanked publicly for their contribution

We recognize security researchers who help us:

For non-vulnerability security questions:

• 💬 GitHub Discussions
• 📖 Security Documentation

For general support (non-security):

• 📧 support@thisjowi.uk
• 🐛 GitHub Issues

This security policy may be updated periodically. Significant changes will be announced via:

• 📢 GitHub release notes
• 📧 Email notifications
• 📱 In-app announcements

Last Updated: November 17, 2025
Version: 1.0.0