We actively support security updates for the following versions:

If you discover a security vulnerability, please report it responsibly:

1. Do not create a public GitHub issue
2. Email the maintainers directly with details
3. Include steps to reproduce if possible
4. Allow reasonable time for response before disclosure

When deploying KaflowSQL:

• Never commit credentials to version control
• Use environment variables for sensitive data
• Regularly rotate access keys and secrets
• Enable S3 checkpointing encryption

• Use TLS for Kafka connections in production
• Restrict network access to required ports
• Use VPC/private networks when possible

• Run containers as non-root user
• Keep base images updated
• Scan images for vulnerabilities
• Use minimal base images

• Enable audit logging
• Monitor for unusual activity
• Set up alerts for failures
• Regular security reviews

1. Acknowledgment: We will acknowledge receipt within 48 hours
2. Assessment: Initial assessment within 5 business days
3. Response: Coordinated disclosure timeline based on severity
4. Resolution: Security patches and advisory publication

Thank you for helping keep KaflowSQL secure!