12764ceb86
- Updated dependencies to latest compatible versions including React, TypeScript, and Vite. - Standardized contact information across all components (phone, email, address, EIN). - Updated copyright year to 2025 and ensured consistent legal status messaging. - Modernized Azure infrastructure with updated API versions and enhanced security practices. - Optimized build configurations for TypeScript and Vite, ensuring production readiness. - Cleaned up console logs and improved code quality with type safety and test coverage updates.
4.3 KiB
4.3 KiB
Security Policy
Supported Versions
We actively maintain and provide security updates for the following versions:
| Version | Supported |
|---|---|
| 1.x.x | ✅ |
Reporting a Vulnerability
The security and privacy of our users is our top priority. If you discover a security vulnerability in our website, please report it responsibly.
How to Report
Please do NOT create a public GitHub issue for security vulnerabilities.
Instead, please:
- Email: Send details to security@miraclesinmotion.org
- Subject Line: "Security Vulnerability Report - [Brief Description]"
- Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested remediation (if known)
- Your contact information
What to Expect
- Acknowledgment: We'll acknowledge receipt within 24 hours
- Initial Assessment: We'll provide an initial assessment within 72 hours
- Regular Updates: We'll keep you informed of our progress
- Timeline: We aim to resolve critical issues within 7 days
- Credit: With your permission, we'll credit you in our security hall of fame
Responsible Disclosure
We ask that you:
- Give us reasonable time to investigate and fix the issue
- Don't access, modify, or delete user data
- Don't perform actions that could negatively impact our users
- Don't publicly disclose the vulnerability until we've addressed it
Security Measures
Website Security
- HTTPS: All traffic encrypted with TLS 1.3
- Content Security Policy: Strict CSP headers implemented
- XSS Protection: Input sanitization and output encoding
- CSRF Protection: Anti-CSRF tokens on all forms
- Security Headers: Comprehensive security headers implemented
Data Protection
- Minimal Collection: We only collect necessary information
- Encryption: Sensitive data encrypted at rest and in transit
- Access Controls: Role-based access to sensitive systems
- Regular Audits: Quarterly security assessments
Donation Security
- PCI Compliance: Payment processing meets PCI DSS standards
- Third-Party Processors: We use certified payment processors
- No Storage: We don't store payment card information
- Fraud Prevention: Advanced fraud detection systems
Privacy Protection
- Data Minimization: Collect only what's necessary
- Purpose Limitation: Use data only for stated purposes
- Retention Policies: Regular data cleanup and deletion
- User Rights: Easy access, correction, and deletion requests
Vulnerability Categories
Critical (24-48 hour response)
- Remote code execution
- SQL injection
- Authentication bypass
- Privilege escalation
- Payment system vulnerabilities
High (72 hour response)
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- Sensitive data exposure
- Broken access controls
Medium (1 week response)
- Security misconfigurations
- Insecure direct object references
- Information disclosure
- Missing security headers
Low (2 week response)
- Clickjacking
- Minor information leakage
- Insecure cookies
- Missing rate limiting
Security Best Practices for Contributors
Code Security
- Validate all user inputs
- Use parameterized queries
- Implement proper authentication
- Follow principle of least privilege
- Keep dependencies updated
Infrastructure Security
- Use environment variables for secrets
- Implement proper logging
- Monitor for unusual activity
- Regular security updates
- Backup and recovery procedures
Security Contact
- Email: security@mim4u.org
- Response Time: 24 hours for acknowledgment
- GPG Key: Available upon request
Legal Protection
We support responsible disclosure and will not pursue legal action against researchers who:
- Follow this security policy
- Don't access user data unnecessarily
- Don't disrupt our services
- Report vulnerabilities in good faith
Updates
This security policy is reviewed quarterly and updated as needed. Last updated: October 2025.
Recognition
We maintain a security hall of fame to recognize researchers who help improve our security:
2025 Contributors
We'll update this section as vulnerabilities are responsibly disclosed and resolved.
Thank you for helping keep Miracles In Motion and our community safe! 🔒