FinAegis is currently in prototype/demonstration phase. Security updates are provided for the latest release only.

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security issues through one of these channels:

1. GitHub Security Advisories (Preferred):

   • Go to the Security tab
   • Click "Report a vulnerability"
   • Fill out the private security advisory form

2. Email:

   • Send details to the repository maintainers
   • Use subject line: [SECURITY] Brief description

Please provide:

1. Description - Clear explanation of the vulnerability
2. Impact - What could an attacker achieve?
3. Steps to Reproduce - Detailed reproduction steps
4. Affected Components - Which files, endpoints, or domains
5. Suggested Fix - If you have one (optional)
6. Your Contact - For follow-up questions

## Vulnerability: SQL Injection in Account Search

### Description
The account search endpoint is vulnerable to SQL injection through
the `search` query parameter.

### Impact
An attacker could extract sensitive data from the database or
potentially modify/delete records.

### Steps to Reproduce
1. Navigate to /api/accounts
2. Add parameter: ?search=' OR '1'='1
3. Observe that all accounts are returned

### Affected Component
- File: app/Http/Controllers/Api/AccountController.php
- Method: index()
- Line: 45

### Suggested Fix
Use parameterized queries or Eloquent's built-in escaping.

1. Receive - We acknowledge your report
2. Assess - We evaluate severity and impact
3. Fix - We develop and test a patch
4. Release - We deploy the fix
5. Disclose - We publish a security advisory
6. Credit - We acknowledge your contribution (if desired)

When contributing code, please:

• Input Validation: Validate all user inputs
• SQL Injection: Use parameterized queries (Eloquent handles this)
• XSS Prevention: Escape output in Blade templates ({{ }} not {!! !!})
• CSRF Protection: Include CSRF tokens in forms
• Authentication: Use Laravel's built-in auth mechanisms
• Authorization: Use policies for access control
• Secrets: Never commit credentials or API keys
• Dependencies: Keep packages updated

If deploying FinAegis (even as a prototype):

• Use HTTPS only
• Set secure cookie flags
• Configure CORS appropriately
• Enable rate limiting
• Use environment variables for secrets
• Regularly update dependencies
• Monitor for suspicious activity

FinAegis includes these security features:

• OAuth2 / Laravel Passport
• API key authentication
• Session management
• Multi-factor authentication (configurable)

• Role-based access control (RBAC)
• Policy-based authorization
• API scope management

• Encrypted sensitive fields
• Audit logging (event sourcing)
• PII handling compliance

• Transaction signing
• Double-entry validation
• Fraud detection (configurable)
• KYC/AML compliance features

• Rate limiting
• IP blocking (configurable)
• CORS configuration
• Security headers

As a prototype, FinAegis has these security considerations:

1. Not Production-Ready: This is a demonstration platform
2. Demo Mode: Demo accounts have known credentials
3. External Services: Mock implementations in demo mode
4. Audit: No formal security audit has been conducted

DO NOT use FinAegis for real financial transactions without:

• Comprehensive security audit
• Regulatory compliance review
• Penetration testing
• Professional security hardening

We appreciate responsible disclosure. Security researchers who report valid vulnerabilities will be:

• Credited in the security advisory (unless anonymity preferred)
• Listed in our security hall of fame
• Thanked in release notes

For security matters:

• GitHub Security Advisories (preferred)
• Repository maintainers via GitHub

For general questions:

• GitHub Discussions

Thank you for helping keep FinAegis secure!