| Version | Supported |
|---|---|
| 0.1.x | ✅ |
If you discover a security vulnerability in AgroVest Backend, please report it responsibly.
- Do NOT open a public GitHub issue for security vulnerabilities
- Email security concerns to: [INSERT SECURITY EMAIL]
- Include the following information:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment within 48 hours
- Status update within 1 week
- Fix timeline depends on severity
| Severity | Description | Response Time |
|---|---|---|
| Critical | Remote code execution, SQL injection, auth bypass | Immediate |
| High | Data exposure, privilege escalation | 48 hours |
| Medium | Denial of service, information disclosure | 1 week |
| Low | Minor issues, best practices | 2 weeks |
When deploying AgroVest Backend:
- Use strong secrets — Generate a cryptographically secure
JWT_SECRET - Enable TLS — Always use HTTPS in production
- Restrict CORS — Set
CORS_ORIGINSto your frontend domain only - Secure database — Use strong PostgreSQL credentials and network isolation
- Keep dependencies updated — Run
cargo updateregularly - Monitor logs — Watch for suspicious authentication attempts
| ID | Endpoint | Class | Fixed in |
|---|---|---|---|
| #6 | GET /api/v1/escrows/{id} |
BOLA — unauthenticated access to financial records | fix/escrow-bola-auth |
We regularly audit our dependencies for known vulnerabilities. To check locally:
cargo install cargo-audit
cargo audit