# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 0.1.x   | :white_check_mark: |

## Reporting a Vulnerability

The LastID team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings.

### How to Report

**Please do NOT report security vulnerabilities through public GitHub issues.**

Instead, please report them via email to:

📧 **security@lastid.co**

### What to Include

Please include the following information in your report:

- Type of vulnerability (e.g., buffer overflow, SQL injection, XSS)
- Full paths of source file(s) related to the vulnerability
- Location of the affected source code (tag/branch/commit or direct URL)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the vulnerability and how an attacker might exploit it

### Response Timeline

- **Initial Response**: Within 48 hours of receiving your report
- **Status Update**: Within 7 days with an assessment
- **Resolution**: We aim to resolve critical vulnerabilities within 30 days

### What to Expect

1. **Acknowledgment**: We will acknowledge your report within 48 hours
2. **Assessment**: Our security team will assess the vulnerability
3. **Communication**: We will keep you informed of our progress
4. **Credit**: With your permission, we will credit you in the security advisory

### Safe Harbor

We consider security research conducted in good faith under this policy to be:

- Authorized concerning any applicable anti-hacking laws
- Authorized concerning any relevant anti-circumvention laws
- Exempt from restrictions in our Terms of Service that would interfere with conducting security research

We will not bring legal action against researchers who:

- Make a good faith effort to avoid privacy violations, destruction of data, and interruption of services
- Only interact with accounts you own or with explicit permission of the account holder
- Do not exploit a vulnerability beyond demonstrating its existence

### Scope

The following are in scope for security research:

- `lastid-sdk` crate and all its features
- WASM bindings and JavaScript interop
- Cryptographic implementations (DPoP, key management)
- Authentication and authorization flows
- Trust registry validation

### Out of Scope

- Denial of service attacks
- Social engineering
- Physical security
- Third-party services or infrastructure

## Security Best Practices

When using this SDK:

1. **Always use HTTPS** in production (HTTP is only allowed for localhost development)
2. **Validate all callbacks** to prevent open redirect vulnerabilities
3. **Store credentials securely** - never log or expose access tokens
4. **Keep dependencies updated** - run `cargo audit` regularly
5. **Use the trust registry** - always validate issuers before accepting credentials

## Acknowledgments

We thank the following researchers for responsibly disclosing vulnerabilities:

*No vulnerabilities have been reported yet.*
