/.github/SECURITY.md

# Security Policy

## Reporting a Vulnerability

We take the security of Composio seriously. If you believe you have found a security vulnerability, please report it to us through GitHub Security Advisories or email us at **security@composio.dev**

### How to Report

**Please do not report security vulnerabilities through public GitHub issues.**

Instead, please report them using one of the following methods:

- **GitHub Security Advisory (Preferred)**: Report a vulnerability directly through GitHub by visiting: [https://github.com/composiohq/composio/security/advisories/new](https://github.com/composiohq/composio/security/advisories/new)
- **Email**: If you prefer not to use GitHub Security Advisories, you can email security concerns to **security@composio.dev**

### What to Include

Please include as much of the following information as possible:

- Type of vulnerability
- Full paths of source file(s) related to the vulnerability
- Location of the affected source code (tag/branch/commit or direct URL)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the vulnerability, including how an attacker might exploit it

### Response Timeline

- We will acknowledge your report within **48 hours**
- We will provide a more detailed response within **7 days** indicating the next steps
- We will keep you informed of the progress toward resolving the issue
- We may ask for additional information or guidance

## Ground Rules

### Do:

- Abide by these Program Terms
- Be patient and make a good faith effort to provide clarifications to any questions we may have about your submission
- Be respectful when interacting with our team, and our team will do the same
- Perform testing only using accounts that are your own personal/test accounts
- Exercise caution when testing to avoid negative impact to data or services
- Respect privacy and make a good faith effort not to change or destroy Composio or personal data
- Stop whenever you are unsure if your test case may cause, or have caused, destructive data or systems damage; report your initial finding(s) and request authorization to continue testing

### Do NOT:

- Leave any system in a more vulnerable state than you found it
- Use or interact with accounts you do not own
- Brute force credentials or guess credentials to gain access to systems or accounts
- Change passwords of any account that is not yours or that you do not have explicit permission to change
- Perform denial of service (DoS) attacks or related tests that would cause availability interruptions or degradation of our services
- Publicly disclose a vulnerability submission without our explicit review and consent
- Engage in any form of social engineering of Composio employees, customers, or partners
- Engage or target any specific Composio employees, customers, or partners during your testing
- Access, extract, or download personal or business information beyond that which is minimally necessary for your Proof-of-Concept purposes
- Do anything that would cause destruction of Composio data or systems
- Test against production systems without permission
- Access or modify user data
- Exploit vulnerabilities beyond what is needed for a proof of concept

## Out-of-Scope Vulnerabilities

Certain vulnerabilities are considered out-of-scope for the Bug Bounty Program. Those out-of-scope vulnerabilities include, but are not limited to:

- Vulnerabilities not involving product or coding flaws, but solely relying upon possession of stolen or compromised credentials
- Vulnerabilities dependent on Phishing in a DNS domain that is not in one of our primary service domains
- Most vulnerabilities that rely on a runtime context within a sandbox, lab, staging, testing or non-production environment
- Vulnerabilities involving stolen or compromised credentials
- Open redirect resulting in a low security impact
- Credential stuffing or physical access to a device
- Any vulnerabilities requiring significant and unlikely interaction by the victim
- Man-in-the-Middle attacks except in mobile applications
- Account enumeration with a pre-defined and known list of UUIDs
- Invite/Promo code enumeration
- Ability to send push notifications/SMS messages/emails without the ability to change content
- Information disclosures related to existence of accounts
- Reports stating that a particular software component is vulnerable without an accompanying proof-of-concept
- Vulnerabilities only affecting users using outdated, unpatched, or unsupported browsers or software
- Stack traces, path disclosure, and directory listings
- CSV injection vulnerabilities
- Best practices concerns without a demonstrable information assurance issue and proof-of-concept
- Ability to take over social media pages
- Negligible security severity
- Speculative reports about theoretical damage – please always provide a proof-of-concept
- Self-XSS or similar vulnerabilities that cannot be used to exploit other users
- Vulnerabilities reported by automated scanning tools without additional analysis
- Distributed or denial of service attacks (DDoS/DoS) and/or reports on rate limiting issues
- Content injection or content spoofing issues
- Cross-site Request Forgery (CSRF) with minimal security implications
- Missing cookie flags on non-authentication cookies
- Submissions that require physical access to a victim's computer/device
- SSL/TLS protocol scan reports
- Banner grabbing issues
- Open ports or services without accompanying proof-of-concept
- Physical or social engineering attempts
- Exposed login panels without proof-of-concept
- Dangling IPs
- Subdomain takeovers without proof
- Reports on third-party products, services, or applications not owned by Composio
- Out-of-scope domains
- Leaked API Key or credentials having no impact on Composio assets

## CVEs and 0-Days

### CVE Age Requirement

We will only accept CVEs that meet all of the criteria below:

- Public for at least **60 days**
- Demonstrated impact on our environment (not theoretical)
- Reproducible with clear steps or proof-of-impact

**CVE reports that do not meet the 60-day requirement are out of scope.**

## Supported Versions

We release patches for security vulnerabilities. Please ensure you are using the latest version of Composio.

## Disclosure Policy

- We follow coordinated disclosure practices
- Security advisories will be published after a fix is available
- We appreciate responsible disclosure and will acknowledge reporters in the advisory (unless you prefer to remain anonymous)

---

**Thank you for helping keep Composio and our users safe!**

We follow responsible disclosure practices and work with researchers to ensure vulnerabilities are properly addressed before public disclosure.