Security Policy

Supported Versions

We officially support the following versions with security updates:

Version	Supported
1.0.x	✅
0.x.x	❌

Reporting a Vulnerability

We take security issues seriously. We appreciate your efforts to responsibly disclose your findings.

Direct Reporting

DO NOT create a public GitHub issue for security vulnerabilities
Instead, email your findings to [bryan.tran.xyz@gmail.com]
Encrypt your findings using our PGP key to prevent information leaks:

You should receive a response within 48 hours
If you don't receive a response, please follow up via https://www.linkedin.com/in/btr-dev/

What to Include

When reporting a vulnerability, please include:

A brief description of the vulnerability
Steps to reproduce the issue
Potential impact of the vulnerability
Any potential solutions you've considered
Whether you plan to disclose this publicly
Your contact information for follow-up

What to Expect

Initial Response: Within 48 hours
Status Update: Within 1 week
Vulnerability Fix: Timeline depends on complexity
Public Disclosure: Coordinated with reporter after fix

Security Best Practices

When using the Chess.com API Client, follow these security practices:

Keep Updated
- Always use the latest version
- Subscribe to security notifications
- Monitor our security advisories

Configuration

# Use secure SSL/TLS settings
client = ChessComClient(
    verify_ssl=True,
    ssl_version="TLSv1_2"
)

Rate Limiting

# Configure appropriate rate limits
client = ChessComClient(
    rate_limit=300,
    max_retries=3
)

Error Handling

# Implement proper error handling
try:
    async with ChessComClient() as client:
        result = await client.get_player("username")
except ChessComAPIError as e:
    log_security_event(e)
    raise

Security Features

TLS/SSL Support
- Enforced HTTPS
- Modern TLS versions
- Certificate validation
Input Validation
- Strict type checking
- Input sanitization
- Parameter validation
Rate Limiting
- Request throttling
- Concurrent request limits
- Automatic backoff
Error Handling
- Secure error messages
- No sensitive data exposure
- Proper exception hierarchy

Development Security

Code Review Requirements
- Security-focused review
- Dependency analysis
- Type safety checks
CI/CD Security
- Automated security scanning
- Dependency auditing
- Container scanning
Dependency Management
- Regular updates
- Vulnerability scanning
- Dependency pinning

Vulnerability Disclosure Policy

Timeline
- Day 0: Initial report received
- Day 2: Initial response provided
- Day 7: Investigation completed
- Day 30: Fix developed and tested
- Day 45: Fix released
- Day 90: Public disclosure
Scope
- API client functionality
- Authentication mechanisms
- Data handling
- Network communication
Out of Scope
- Chess.com API issues
- Known rate limiting
- Theoretical attacks
- Already reported issues

Security Advisories

We publish security advisories for:

Critical vulnerabilities
Important security updates
Security-related version releases
Best practice recommendations

Contact

Security Email: [bryan.tran.xyz@gmail.com]
PGP Key: [046CA1AB964E9EBB714396B8F8058D72016F1F27]

Attribution

We aim to acknowledge security researchers who help improve our security. Researchers will be credited (with permission) in:

Security advisories
Release notes
Hall of fame

Navigation Menu

Security

SECURITY.md

Security Policy

Supported Versions

Reporting a Vulnerability

Direct Reporting

What to Include

What to Expect

Security Best Practices

Security Features

Development Security

Vulnerability Disclosure Policy

Security Advisories

Contact

Attribution

There aren't any published security advisories

Security: Stupidoodle/chess-com-api

Security

SECURITY.md

Security Policy

Supported Versions

Reporting a Vulnerability

Direct Reporting

What to Include

What to Expect

Security Best Practices

Security Features

Development Security

Vulnerability Disclosure Policy

Security Advisories

Contact

Attribution

There aren't any published security advisories