We take security seriously. If you discover a security vulnerability in sreq, please report it responsibly.

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Email the maintainer directly at [email protected]
3. Include as much detail as possible:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours of your report
• Status Update: Within 7 days with an assessment
• Resolution: Timeline depends on severity and complexity

When using sreq, follow these security practices:

• Never commit your .sreq.yaml config if it contains hardcoded secrets
• Use environment variables or secret managers for sensitive data
• Rotate credentials regularly

• Use IAM roles when possible (especially in CI/CD or EC2)
• Follow the principle of least privilege
• Enable MFA for AWS accounts
• Use separate credentials for development and production

• Use ACL tokens with minimal required permissions
• Rotate Consul tokens periodically
• Never share tokens across environments

• Add *.local.yaml to your .gitignore
• Keep production configs separate from development
• Review configs before sharing or committing

• No credential logging: sreq never logs sensitive values
• Secure defaults: Timeouts and connection limits are set conservatively
• Provider isolation: Each provider handles its own authentication

We appreciate responsible disclosure and will acknowledge security researchers who help improve sreq's security.