If you discover a security vulnerability in fal-go, please do not create a public issue.

Instead, send your report privately:

1. GitHub Security Advisory (Recommended):

   • Visit https://github.com/valksor/fal-go/security/advisories
   • Click "Report a vulnerability"
   • Fill in the details
   • Your report will be private and visible only to maintainers

2. Email:

   • Send details to packages@valksor.com
   • Include "SECURITY: fal-go" in the subject line

Please include as much detail as possible:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested mitigation (if known)
• Your name/handle for credit (optional)

• Initial response: Within 48 hours
• Detailed assessment: Within 7 days
• Patch release: Based on severity, typically within 14 days

Security updates are provided for the latest minor release of the current major version.

• Keep updated: Depend on the latest release to get security fixes.
• Secure your key: Provide FAL_KEY via the environment or a .env file; never commit credentials.
• Realtime JWT: By default the realtime JWT is placed in the WebSocket URL query string (matching the Python client), which intermediaries may log. Use WithJWT(false) to send it as an Authorization header instead.
• Audit dependencies: Run make vuln (govulncheck) in your own pipeline.

• No credentials in logs: Never log API keys, tokens, or sensitive data.
• Use context: Always pass context.Context for cancelable operations.
• Error handling: Don't expose sensitive information in error messages.
• Dependency scanning: govulncheck runs in CI and via make vuln.

For security-related questions not involving vulnerability disclosure:

• General security inquiries: security@valksor.com
• GitHub Security Advisories: https://github.com/valksor/fal-go/security/advisories

Thank you for helping keep fal-go secure!