system-prompts-and-models-of-ai-tools/dealix/SECURITY.md

Security Policy | سياسة الأمن

🛡️ Supported versions

Version	Supported
2.x	✅
1.x	❌ (EOL)

🐛 Reporting a vulnerability

Please do NOT open a public issue for security vulnerabilities.

Instead, report them privately via:

• Email: security@ai-company.sa
• GitHub Security Advisories: Open a private advisory

Include:

1. A description of the vulnerability.
2. Steps to reproduce.
3. Potential impact.
4. Any suggested fixes.

We aim to acknowledge within 48 hours and provide a resolution timeline within 7 days.

🔒 Security features in this project

• Config: all secrets loaded from .env via pydantic-settings with SecretStr.
• Secret scanning: gitleaks + detect-secrets + trufflehog in pre-commit AND CI.
• Dependency scanning: Dependabot weekly + bandit Python security linter.
• Docker: non-root user, multi-stage build, minimal base image.
• Webhooks: HMAC-SHA256 signature verification (WhatsApp).
• LinkedIn integration: disabled by default (ToS compliance).

🔑 Key rotation guidance

If you believe a key has been exposed:

1. Immediately rotate the key in the provider's dashboard:
   • Anthropic Console → API Keys → regenerate
   • DeepSeek, Groq, GLM, Google, OpenAI: regenerate in respective consoles
   • HubSpot, Resend, SendGrid: regenerate
   • WhatsApp Business: regenerate access token
2. Update .env with the new key.
3. Redeploy.
4. Check GitHub → Settings → Secret scanning alerts.
5. Run gitleaks detect --source . --report-format json to scan history.

✅ Pre-commit checklist for maintainers

Before merging any PR:

• gitleaks pre-commit hook passed
• No new files in .env* except .env.example
• No new domain-specific secrets in core/ or integrations/
• All new integrations use settings.*_api_key.get_secret_value() pattern

---

🇸🇦 بالعربية

الإبلاغ عن ثغرات

لا تفتح issue عام للثغرات الأمنية. أرسل إلى: security@ai-company.sa

نهدف للرد خلال ٤٨ ساعة وتقديم جدول زمني للحل خلال ٧ أيام.

تدوير المفاتيح

إذا تسرّب مفتاح:

1. فوراً دوّر المفتاح من لوحة المزود.
2. حدّث .env.
3. أعد النشر.
4. افحص تنبيهات GitHub secret scanning.