Note: This project is currently in pre-release and NOT production-ready. See PRODUCTION_READINESS_REPORT.md for details.

We take the security of rx-ui seriously. If you discover a security vulnerability, please follow these steps:

DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please report security issues by emailing: security@yourdomain.com (replace with actual email)

Please provide:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (if available)
• Your contact information

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 1 week
• Fix Timeline: Depends on severity
  • Critical: 1-3 days
  • High: 1-2 weeks
  • Medium: 2-4 weeks
  • Low: Best effort

See PRODUCTION_READINESS_REPORT.md for complete list of security issues.

Critical Issues:

1. RLS Policies Allow Public Access - Anyone can read/modify all data
2. TOTP Secrets Stored in Plain Text - No encryption at rest
3. No Input Validation - XSS vulnerabilities
4. No Rate Limiting - Brute force attacks possible
5. Environment Variables May Be Exposed - Check git history

DO NOT USE IN PRODUCTION until these are resolved.

1. Never commit secrets

   • Use .env files (git-ignored)
   • Use environment variables in CI/CD
   • Rotate credentials if exposed

2. Validate all inputs

   • Use schema validation (Zod, Yup)
   • Sanitize HTML content (DOMPurify)
   • Validate on both client and server

3. Follow secure coding practices

   • Use prepared statements (Supabase handles this)
   • Implement proper error handling
   • Log security events

4. Keep dependencies updated

   npm audit
   npm audit fix

5. Test security controls

   • Add security tests
   • Perform penetration testing
   • Use automated security scanning

1. HTTPS Only

   • Force HTTPS redirects
   • Use HSTS headers
   • Valid SSL certificates

2. Environment Configuration

   • Separate dev/staging/production
   • Rotate production secrets regularly
   • Use secrets management (AWS Secrets Manager, HashiCorp Vault)

3. Access Controls

   • Implement proper authentication
   • Use Row Level Security (RLS) correctly
   • Principle of least privilege

4. Monitoring

   • Set up error tracking (Sentry)
   • Monitor failed login attempts
   • Alert on suspicious activity

5. Backup & Recovery

   • Regular database backups
   • Test restore procedures
   • Document recovery process

This application handles prescription data which may be considered PHI (Protected Health Information) under HIPAA.

Requirements for HIPAA Compliance:

• Business Associate Agreement (BAA) with Supabase
• Encryption at rest and in transit
• Audit logging for all PHI access
• Access controls and authentication
• Data retention and disposal policies
• Breach notification procedures
• Regular security risk assessments
• Staff training on HIPAA compliance

Current Status: ❌ NOT HIPAA COMPLIANT

• Privacy policy
• User consent management
• Data portability (export)
• Right to be forgotten (deletion)
• Data processing agreement with Supabase
• Cookie consent

Current Status: ❌ NOT GDPR COMPLIANT

Before production deployment:

• Fix RLS policies with proper user checks
• Implement rate limiting on auth endpoints
• Add account lockout after failed attempts
• Encrypt TOTP secrets at rest
• Use secure session management

• Validate and sanitize all inputs
• Implement output encoding (prevent XSS)
• Use parameterized queries (prevent SQL injection)
• Encrypt sensitive data at rest
• Use HTTPS only

• Remove .env from git history
• Rotate all exposed credentials
• Set up Web Application Firewall (WAF)
• Configure security headers (CSP, HSTS, X-Frame-Options)
• Disable directory listing
• Remove development tools from production

• Set up error tracking (Sentry)
• Implement audit logging
• Monitor for suspicious activity
• Set up alerts for security events
• Regular security log reviews

• Add comprehensive test coverage
• Perform code security review
• Run static analysis tools (ESLint security rules)
• Dependency vulnerability scanning
• Remove debug code and console.logs

1. Dependency Scanning

   • npm audit (built-in)
   • Snyk
   • Dependabot (GitHub)

2. Static Analysis

   • ESLint with security plugins
   • SonarQube

3. Runtime Security

   • Sentry (error tracking)
   • LogRocket (session replay)

4. Penetration Testing

   • OWASP ZAP
   • Burp Suite

For security-related questions:

• Email: security@yourdomain.com (replace with actual)
• Bug Bounty: Not yet established

This security policy is reviewed and updated quarterly.

Last Updated: October 29, 2025
Next Review: January 29, 2026