# Security Policy

## Supported Versions

We actively maintain security fixes for the following versions of Droidwatch:

| Version | Supported |
|---------|-----------|
| `main` (latest) | Yes — security patches applied immediately |
| Previous minor releases (≤ 3 months old) | Yes — critical patches backported |
| Older releases | No — please upgrade |

---

## Responsible Disclosure Policy

We take the security of Droidwatch and the safety of our users seriously. If you believe you have found a security vulnerability, we encourage you to disclose it responsibly.

### How to Report

**Email:** admin@droidwatch.app

Please include as much of the following as possible:

- A clear description of the vulnerability and its potential impact
- Steps to reproduce (proof-of-concept or exploit code, if applicable)
- Affected component, endpoint, or file path
- Any suggested mitigations or fixes

### PGP Key

For sensitive reports, encrypt your email using our PGP key:

```
-----BEGIN PGP PUBLIC KEY BLOCK-----
[PGP PUBLIC KEY PLACEHOLDER — REPLACE BEFORE PUBLISHING]
-----END PGP PUBLIC KEY BLOCK-----
```

Key fingerprint: `XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX`

We will publish the real key at `https://droidwatch.app/.well-known/security.txt` once it is generated.

---

## Response Timeline

| Milestone | Target |
|-----------|--------|
| Acknowledgement of receipt | Within **48 hours** |
| Initial triage and severity assessment | Within **5 business days** |
| Patch for Critical / High severity | Within **30 days** |
| Patch for Medium severity | Within **60 days** |
| Patch for Low / Informational | Within **90 days** |
| Public disclosure (coordinated) | After patch is available and users have had time to update |

We will keep you informed at each stage. If we need more time due to complexity, we will communicate proactively and agree on a disclosure date with you.

---

## Scope

### In Scope

The following are considered in scope for vulnerability reports:

- **API endpoints** under `/api/` — authentication bypass, authorization issues, injection, insecure direct object references, rate-limit bypasses
- **Authentication system** — JWT handling, session management, TOTP implementation, password reset flows
- **File upload handling** — path traversal, malicious APK that causes server-side code execution, SSRF via APK analysis
- **Frontend** (hosted at `droidwatch.app`) — XSS, CSRF, open redirects, clickjacking
- **Report sharing / public links** — unauthorized access to private reports via share tokens
- **Infrastructure** (production only) — misconfigurations exposing sensitive data

### Out of Scope

The following are explicitly out of scope:

- Vulnerabilities in third-party services we integrate with (VirusTotal, MobSF, AbuseIPDB) — report those directly to the respective vendors
- Self-XSS (where the attacker can only affect their own session)
- Denial-of-service attacks that require sending large volumes of traffic (volumetric DDoS)
- Social engineering of Droidwatch employees or users
- Physical security attacks
- Issues in software or systems not owned or operated by Droidwatch
- Known vulnerabilities in dependencies without a demonstrated exploit against Droidwatch
- Missing security headers or TLS configuration without demonstrated impact
- Automated scanner output without manual verification of exploitability

---

## Bug Bounty

Droidwatch does not currently operate a formal paid bug bounty program. However, we deeply appreciate the effort of security researchers who help keep the platform safe.

**Researchers who responsibly disclose valid vulnerabilities will be:**

- Publicly recognized in our **Hall of Fame** (with your permission) on our website
- Credited in the relevant security advisory / changelog entry
- Given early access to the fixed release for verification

We are evaluating a formal bounty program for the future. Thank you for your understanding.

---

## Safe Harbor

Droidwatch values the work of security researchers. We will not pursue legal action against researchers who:

1. Discover and report vulnerabilities through this responsible disclosure process in good faith
2. Avoid accessing, modifying, or deleting data belonging to other users
3. Do not perform actions that could harm the availability or integrity of the service (e.g. destructive attacks, mass data exfiltration)
4. Do not publicly disclose the vulnerability before we have had a reasonable opportunity to address it
5. Do not violate applicable laws in their research

We consider responsible security research to be a valuable contribution and will work collaboratively with researchers to understand and resolve issues promptly.

---

## Security Contact

**Email:** admin@droidwatch.app  
**Response hours:** Business hours (UTC); critical issues escalated 24/7  
**PGP:** See above