We release patches for security vulnerabilities for the following versions:

The WSO2 Integration Store team takes security seriously. We appreciate your efforts to responsibly disclose your findings.

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them through one of the following methods:

1. Email: Send details to security@wso2.com
2. WSO2 Security Portal: Visit https://wso2.com/security

When reporting a vulnerability, please include:

• Description: A clear description of the vulnerability
• Impact: Potential impact and severity assessment
• Steps to Reproduce: Detailed steps to reproduce the issue
• Proof of Concept: Code snippets or screenshots if applicable
• Affected Versions: Which versions are affected
• Suggested Fix: If you have recommendations (optional)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 7-14 days
  • High: 14-30 days
  • Medium: 30-60 days
  • Low: 60-90 days

1. Acknowledgment: We'll confirm receipt of your report
2. Assessment: We'll assess the vulnerability and determine severity
3. Updates: Regular updates on fix progress
4. Disclosure: Coordinated disclosure after fix is released
5. Credit: We'll credit you in the security advisory (if desired)

• Keep your installation up to date with the latest version
• Follow the security guidelines in our documentation
• Use HTTPS for all deployments
• Implement proper authentication and authorization
• Regular security audits of your deployment

• Follow secure coding practices
• Run security linters and tests before submitting PRs
• Never commit secrets, API keys, or credentials
• Review dependencies for known vulnerabilities (npm audit)
• Follow the principle of least privilege

• Public API: Uses public Ballerina Central API (no authentication required)
• No User Data: Application doesn't store or process user data
• Client-Side Only: All operations are client-side (no backend)
• No Secrets: No API keys or sensitive data in the application

We regularly monitor and update dependencies to address security vulnerabilities:

# Check for vulnerabilities
npm audit

# Fix auto-fixable vulnerabilities
npm audit fix

Current status: 0 known vulnerabilities

When deploying, ensure the following security headers are configured:

• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• Strict-Transport-Security
• Referrer-Policy

Example Next.js configuration:

// next.config.js
const securityHeaders = [
  {
    key: 'X-Frame-Options',
    value: 'SAMEORIGIN',
  },
  {
    key: 'X-Content-Type-Options',
    value: 'nosniff',
  },
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=31536000; includeSubDomains',
  },
];

module.exports = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: securityHeaders,
      },
    ];
  },
};

• Coordinated Disclosure: We practice responsible disclosure
• Security Advisories: Published via GitHub Security Advisories
• CVE Assignment: For applicable vulnerabilities
• Public Disclosure: After fix is released and users have time to update

We recognize security researchers who help make our project safer:

No reports yet - be the first!

• General Security Questions: security@wso2.com
• Project Team: See CONTRIBUTING.md

Thank you for helping keep WSO2 Integration Store secure!