Any vulnerability found should be reported directly to the maintainer listed in README.md (David Lima, david.lima@inesctec.pt). If you are still waiting for a response within 48 hours, please send a follow-up email to confirm the initial message was received.

Please write reports in English.

We encourage all contributors to follow security best practices when contributing code:

• Validate input: Always sanitize and validate user input to prevent injection attacks (SQL injection, XSS, etc.). In particular, never interpolate request-derived values directly into SQL strings -- use parameterized queries (cursor.execute(query, params)), as is done throughout gridarena/database/ and gridarena/routers/.
• Use secure protocols: Prefer HTTPS over HTTP for all external communication.
• Minimize permissions: Follow the principle of least privilege when assigning database and system permissions.
• Never hardcode secrets: Database credentials and other secrets must come from environment variables (see GRID_DB_DSN / DATABASE_URL in gridarena/database/database_connection.py), never committed to the repo.
• Regularly update dependencies: Keep requirements.txt dependencies up to date and free from known vulnerabilities.

• Acknowledgment: We will acknowledge receipt of your report within 48 hours.
• Assessment: We will assess the severity and potential impact of the vulnerability.
• Fix and mitigation: We will implement a fix or mitigation strategy and document it in CHANGELOG.md.
• Disclosure: After the fix is deployed, we will provide a public disclosure with details of the vulnerability, its severity, and the fix.

Each entry should include:

• Severity level (e.g., moderate, high, critical).
• Publication timeline: an estimated release date for the security fix, typically 30 to 60 days after the code is made public.

This ensures transparency and informs users about the actions taken to mitigate security risks.

If you have encountered a security issue or vulnerability, please include the following information in your report to help us address it efficiently:

Thank you for helping us improve the security of the project.