We take security seriously. If you discover a security vulnerability in CLASP, please report it responsibly.

1. DO NOT create a public GitHub issue for security vulnerabilities
2. Email security concerns to the repository maintainers via GitHub's private vulnerability reporting feature
3. Or, use GitHub's Security Advisory feature: https://github.com/jedarden/CLASP/security/advisories/new

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution Target: Within 30 days for critical issues

CLASP implements several security best practices:

• API keys are masked in logs using MaskAPIKey(), MaskAllSecrets(), and MaskJSONSecrets()
• No secrets are stored in plain text
• Environment variables are the recommended method for API key configuration

• Optional API key authentication for the proxy endpoint
• Timing-attack resistant key comparison using subtle.ConstantTimeCompare()
• Configurable anonymous access for health and metrics endpoints

• Configurable rate limiting to prevent abuse
• Token bucket algorithm with burst support

• Request validation for required fields
• JSON schema validation for API requests

• Dependabot enabled for automatic security updates
• Regular dependency audits via go mod tidy and npm audit

# Enable authentication
export AUTH_ENABLED=true
export AUTH_API_KEY=your-secure-api-key

# Enable rate limiting
export RATE_LIMIT_ENABLED=true
export RATE_LIMIT_REQUESTS=60
export RATE_LIMIT_WINDOW=60

# Enable circuit breaker
export CIRCUIT_BREAKER_ENABLED=true

CLASP will log warnings at startup if:

• Authentication is disabled
• Rate limiting is disabled

This project uses:

• gitleaks: Secret detection in commits
• gosec: Go security scanner
• Dependabot: Automated dependency updates
• CodeQL: GitHub's semantic code analysis (planned)

• Security vulnerabilities will be disclosed after a fix is available
• Credit will be given to reporters unless they prefer anonymity
• We follow coordinated disclosure practices