Skip to content

SECURITY.md

Jump to bottom
Shashank Patil edited this page Jul 26, 2026 · 1 revision

Security Policy

Thank you for helping keep the Generic SQL API Framework secure.

We take security seriously and appreciate responsible disclosure of vulnerabilities.

Supported Versions

The following table indicates which versions currently receive security updates.

Version Supported
1.x ✅ Yes
< 1.0 ❌ No

Reporting a Vulnerability

If you discover a security vulnerability, please do not create a public GitHub Issue.

Instead:

  1. Contact the project maintainer privately.
  2. Include a detailed description of the vulnerability.
  3. Provide steps to reproduce the issue.
  4. Include any relevant logs or screenshots.
  5. If possible, include a suggested fix.

We will investigate the report and respond as quickly as possible.

What to Include

A good security report should include:

  • Framework version
  • PHP version
  • Database version
  • Operating system
  • Steps to reproduce
  • Expected behavior
  • Actual behavior
  • Proof of concept (if available)

Response Process

After receiving a report, we will:

  1. Confirm receipt of the report.
  2. Investigate the issue.
  3. Assess the impact.
  4. Develop and test a fix.
  5. Release a security update if necessary.
  6. Credit the reporter (if they wish to be acknowledged).

Responsible Disclosure

Please:

  • Give us reasonable time to investigate and fix the issue.
  • Avoid publicly disclosing vulnerabilities before a fix is available.
  • Do not access, modify, or delete data that does not belong to you.
  • Do not perform denial-of-service (DoS) testing against production systems.

We appreciate responsible disclosure and collaboration.

Security Best Practices

When deploying the Generic SQL API Framework:

  • Use parameterized queries.
  • Validate all user input.
  • Keep PHP and SQL Server up to date.
  • Use HTTPS in production.
  • Store database credentials securely.
  • Use a dedicated database account with the minimum required permissions.
  • Restrict access to the database server using firewalls or network controls.
  • Review application logs regularly.

For additional guidance, see the Security Best Practices section in the project documentation.

Acknowledgements

We thank everyone who helps improve the security of the Generic SQL API Framework through responsible reporting and constructive feedback.

Clone this wiki locally