We actively support and provide security updates for the following versions of BOSS:

We take security vulnerabilities seriously. If you discover a security issue in BOSS, please report it responsibly.

1. DO NOT create a public GitHub issue for security vulnerabilities
2. Email us directly: security@risalabs.ai
3. Include in your report:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Your contact information
   • Any proof-of-concept code (if applicable)

• Initial Response: Within 24-48 hours of receiving your report
• Confirmation: Within 1 week - we'll confirm if the issue is a valid security vulnerability
• Updates: Regular updates every 1-2 weeks during investigation
• Resolution: Security fixes will be prioritized and released as soon as possible

We appreciate security researchers who follow responsible disclosure practices. While we don't have a formal bug bounty program, we will:

• Acknowledge your contribution in our security advisories
• Credit you in our release notes (unless you prefer to remain anonymous)
• Provide early access to fixes for verification

BOSS implements several security measures:

• All releases are built in GitHub Actions with auditable logs
• Dependencies are scanned for vulnerabilities
• Code signing for macOS and Windows releases
• Automated security audits

• Sandboxed execution where possible
• Secure credential storage
• Input validation and sanitization
• HTTPS-only external connections

• Signed releases (macOS notarization, Windows signing)
• Checksums for all distributed files
• Official distribution through GitHub Releases only

• BOSS runs as a desktop application with local file system access
• Terminal integration provides shell access (by design)
• Browser integration may access web content
• LLM integration involves external API calls

• Configuration files are stored locally
• API keys are stored in local configuration
• Users should protect their ~/.boss/ directory appropriately

• Download BOSS only from official GitHub Releases
• Verify checksums of downloaded files
• Use official installers (DMG, MSI) when available

• Store API keys securely
• Regularly review and rotate API credentials
• Use environment variables for sensitive configuration
• Set appropriate file permissions on configuration directories

• Enable automatic updates when available
• Regularly check for security updates
• Review release notes for security fixes

• Use BOSS in trusted network environments
• Be aware of data transmitted to external services (LLM APIs, etc.)
• Review privacy policies of integrated services

If you're contributing to BOSS, please consider these security aspects:

• Input validation for all user inputs
• Secure handling of credentials and API keys
• Protection against path traversal attacks
• Safe handling of external process execution
• Proper error handling (avoid information disclosure)

• Security test cases for new features
• Validation of authentication/authorization logic
• Testing with malicious inputs
• Cross-platform security considerations

• Security implications clearly documented
• Installation and configuration security notes
• API security guidelines for integrations

• OWASP Desktop App Security
• Electron Security Guidelines (applicable principles)
• Kotlin Security Best Practices

• GitHub Security Advisories
• Dependabot for dependency vulnerabilities
• CodeQL for static analysis
• TruffleHog for secrets scanning
• OWASP Dependency Check

• Security Email: security@risalabs.ai
• General Issues: GitHub Issues
• Website: https://www.risalabs.ai

Remember: When in doubt about security, it's better to be cautious and report potential issues rather than ignore them. We appreciate your help in keeping BOSS secure for everyone! 🙏