We release patches for security vulnerabilities for the following versions:

We take the security of AutoCron seriously. If you believe you have found a security vulnerability, please report it to us as described below.

• Open a public GitHub issue
• Disclose the vulnerability publicly before we've had a chance to address it

1. Email us directly at: mdshoaibuddinchanda@gmail.com
2. Include the following information:

• Type of vulnerability
• Full paths of source file(s) related to the vulnerability
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability
• Your suggestions for mitigation (if any)

• Acknowledgment: We will acknowledge receipt of your vulnerability report within 48 hours
• Assessment: We will assess the vulnerability and determine its impact
• Timeline: We will provide an estimated timeline for a fix
• Updates: We will keep you informed of our progress
• Credit: We will credit you for the discovery (unless you prefer to remain anonymous)
• Disclosure: Once the vulnerability is fixed, we will coordinate public disclosure

1. Vulnerability is reported and confirmed
2. Fix is developed and tested
3. Security advisory is drafted
4. Patch is released
5. Security advisory is published
6. CVE is requested (if applicable)

When using AutoCron:

Safe Mode provides sandboxed execution with resource limits to protect against:

• Runaway scripts consuming excessive memory
• CPU-intensive tasks blocking the system
• Arbitrary code execution risks
• Task failures affecting other tasks

Enable Safe Mode for:

from autocron import AutoCron

scheduler = AutoCron()

# Untrusted or resource-intensive scripts
scheduler.add_task(
 name="external_script",
 script="user_provided.py",
 every="1h",
 safe_mode=True, # Enable process isolation
 max_memory_mb=256, # Limit memory to 256MB
 max_cpu_percent=50, # Limit CPU to 50% (Unix only)
 timeout=300 # 5 minute timeout
)

Safe Mode Features:

• Process Isolation: Tasks run in separate subprocess
• Memory Limits: Enforce maximum memory usage (Unix/Linux/Mac)
• CPU Limits: Control CPU consumption (Unix/Linux/Mac)
• Timeout Enforcement: Hard kill after specified time
• Output Sanitization: Truncate large outputs (10KB limit)
• Error Containment: Failures don't affect parent process

When to Use Safe Mode:

• Running user-provided scripts
• Production environments with strict SLAs
• Multi-tenant task scheduling
• Tasks with unknown resource requirements
• Scripts that process external data

Safe Mode Limitations:

• ️ Only works with script-based tasks (not function tasks)
• ️ Slight performance overhead (subprocess creation)
• ️ Resource limits more effective on Unix/Linux/Mac

• Never hardcode credentials in scripts or configuration files
• Use environment variables for sensitive data
• Use a secrets management system (e.g., AWS Secrets Manager, HashiCorp Vault)

import os

email_config = {
 'smtp_server': 'smtp.gmail.com',
 'smtp_port': 587,
 'from_email': os.environ.get('EMAIL_FROM'),
 'to_email': os.environ.get('EMAIL_TO'),
 'password': os.environ.get('EMAIL_PASSWORD')
}

• Use Safe Mode for untrusted scripts (v1.2.0+)
• Validate and sanitize all script paths
• Use absolute paths when possible
• Set appropriate file permissions
• Run with least privilege necessary

import os
from autocron import AutoCron

scheduler = AutoCron()

# Validate script path
script_path = os.path.abspath(user_provided_path)
if not script_path.startswith('/safe/directory/'):
 raise ValueError("Invalid script path")

# Run with safe mode
scheduler.add_task(
 name="validated_task",
 script=script_path,
 every="1h",
 safe_mode=True, # Enable sandboxing
 max_memory_mb=200,
 timeout=600
)

• Validate all user inputs
• Sanitize task names and descriptions
• Validate cron expressions
• Check file paths before execution

• Don't log sensitive information
• Sanitize logs before storage
• Rotate and secure log files
• Monitor logs for suspicious activity

• Use TLS for email notifications
• Validate SSL certificates
• Use secure SMTP configurations
• Implement rate limiting

• Keep AutoCron updated
• Review scheduled tasks regularly
• Audit task execution logs
• Monitor system resources

AutoCron can integrate with OS-level schedulers (cron, Task Scheduler):

• Tasks run with user privileges
• Review scheduled tasks regularly
• Secure crontab/Task Scheduler access
• Monitor for unauthorized task modifications

Email notifications require SMTP credentials:

• Use app-specific passwords
• Enable 2FA on email accounts
• Rotate credentials regularly
• Monitor for unauthorized access

AutoCron executes Python scripts:

• Review scripts before scheduling
• Use code signing when possible
• Implement script whitelisting
• Monitor script modifications

Security advisories will be published:

• GitHub Security Advisories
• Project documentation
• Mailing list (if subscribed)
• Twitter/social media

AutoCron strives to follow:

• OWASP Top 10 guidelines
• CWE/SANS Top 25
• Python security best practices
• Industry-standard security practices

For security concerns, contact:

• Email: mdshoaibuddinchanda@gmail.com
• PGP Key: [Contact for PGP key]

For general questions:

• GitHub Issues: https://github.com/mdshoaibuddinchanda/autocron/issues
• GitHub Discussions: https://github.com/mdshoaibuddinchanda/autocron/discussions

Thank you for helping keep AutoCron and our users safe!