We currently support security updates for the following versions of Modulo:

We take security vulnerabilities seriously. If you discover a security vulnerability in Modulo, please report it responsibly.

1. DO NOT create a public GitHub issue for security vulnerabilities
2. Send an email to security@modulo.dev with details about the vulnerability
3. Include steps to reproduce the issue if possible
4. We will acknowledge receipt within 48 hours

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any suggested fixes or mitigations
• Your contact information for follow-up

• 48 hours: Initial response acknowledging the report
• 7 days: Preliminary assessment and severity classification
• 14 days: Detailed investigation and fix development
• 30 days: Security patch release and public disclosure

Modulo implements several security measures:

• CodeQL Analysis: Comprehensive static analysis for Java and TypeScript
• Dependency Scanning: Automated vulnerability detection in dependencies
• Container Scanning: Docker image security analysis
• SARIF Integration: Security findings tracked in GitHub Security tab

• Security Gates: PRs blocked on high-severity security findings
• Regular Updates: Dependencies updated for security patches
• Security Reviews: Manual security review for sensitive changes
• Principle of Least Privilege: Minimal required permissions

• Network Isolation: Kubernetes network policies and security groups
• Secrets Management: Azure Key Vault and Kubernetes secrets
• TLS Encryption: End-to-end encryption for all communications
• Authentication: Multi-factor authentication support

• OWASP Top 10: Protection against common web vulnerabilities
• CWE/SANS 25: Coverage of most dangerous software errors
• SOC 2 Type II: Continuous security monitoring
• Security Audits: Regular third-party security assessments

• Follow secure coding guidelines
• Validate all user inputs
• Use parameterized queries for database access
• Implement proper error handling without information disclosure
• Use strong authentication and authorization mechanisms

• Keep dependencies up to date
• Use known secure versions
• Avoid dependencies with known vulnerabilities
• Regularly audit dependency security

• Use environment variables for sensitive configuration
• Implement proper secrets management
• Follow principle of least privilege
• Enable security headers and CSP

We follow responsible disclosure practices:

1. Report received: We acknowledge the security report
2. Investigation: We investigate and validate the vulnerability
3. Fix development: We develop and test a security fix
4. Coordinated release: We coordinate the release with the reporter
5. Public disclosure: We publicly disclose the vulnerability after the fix is released

We recognize security researchers who help improve Modulo's security:

• Security researchers will be credited in release notes (with permission)
• Researchers may be eligible for bug bounty rewards (when program is active)
• We maintain a security acknowledgments page

Security updates are communicated through:

• GitHub Security Advisories: Official security notifications
• Release Notes: Security fixes documented in releases
• Mailing List: security-announce@modulo.dev
• Documentation: Security updates documented in changelog

1. Security patch development: Fix developed in private repository
2. Testing: Comprehensive testing including security validation
3. Release preparation: Release notes and upgrade instructions
4. Coordinated release: Security patch released across all supported versions
5. Public notification: Security advisory published

• Security Email: security@modulo.dev
• Security Team Lead: security-lead@modulo.dev
• General Contact: info@modulo.dev

For urgent security matters, please contact security@modulo.dev directly.

This security policy is effective as of August 2025 and is subject to updates. Please check this page regularly for the latest security information.