The ChessReviewEngine team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security vulnerabilities by:

1. GitHub Security Advisories (Preferred)

   • Navigate to the Security Advisories page
   • Click "Report a vulnerability"
   • Fill in the details of the vulnerability
   • Submit the report

2. Private Disclosure

   • Create a private issue or contact the maintainers directly
   • Mark the issue as confidential/security-related
   • Provide detailed information about the vulnerability

To help us understand and resolve the issue quickly, please include:

• Type of vulnerability (e.g., SQL injection, XSS, authentication bypass)
• Full paths of affected source files
• Location of the affected code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability (what an attacker could do)
• Suggested fix (if you have one)
• Your contact information for follow-up questions

**Vulnerability Type:** Cross-Site Scripting (XSS)

**Affected Component:** Frontend - PGN input handler

**Location:** src/components/PGNUpload.tsx, lines 45-50

**Description:**
User-provided PGN input is rendered without proper sanitization,
allowing execution of arbitrary JavaScript code.

**Steps to Reproduce:**
1. Navigate to the PGN upload page
2. Enter the following PGN: <script>alert('XSS')</script>
3. Click "Analyze Game"
4. Observe the JavaScript execution

**Impact:**
An attacker could inject malicious scripts to steal session tokens
or perform actions on behalf of users.

**Suggested Fix:**
Sanitize user input using DOMPurify before rendering.

**Reporter Contact:** security@example.com

When contributing to ChessReviewEngine, please follow these security guidelines:

• Always validate user input on both client and server side
• Sanitize PGN input before processing
• Validate file uploads (type, size, content)
• Use parameterized queries if database integration is added

• Never commit credentials or API keys to the repository
• Use environment variables for sensitive configuration
• Implement proper access controls for any admin features

• Keep dependencies up-to-date to patch known vulnerabilities
• Review security advisories for npm and pip packages
• Use npm audit and pip-audit regularly
• Avoid deprecated or unmaintained packages

• Don't log sensitive information (passwords, tokens, etc.)
• Encrypt sensitive data in transit and at rest (if applicable)
• Follow GDPR/privacy guidelines if handling user data

• Avoid eval() and similar dynamic code execution
• Use secure random generators for tokens/IDs
• Implement rate limiting on API endpoints
• Add CORS restrictions appropriately
• Escape output to prevent XSS attacks

We are committed to responding to security reports promptly:

We categorize vulnerabilities using the following severity levels:

• Critical: Remote code execution, authentication bypass, data breach

  • Fix target: Within 24-48 hours

• High: XSS, CSRF, SQL injection, privilege escalation

  • Fix target: Within 1 week

• Medium: Information disclosure, denial of service

  • Fix target: Within 2-4 weeks

• Low: Minor issues with minimal impact

  • Fix target: Next scheduled release

We recognize and thank security researchers who responsibly disclose vulnerabilities:

No vulnerabilities reported yet. Be the first to help secure ChessReviewEngine!

Security patches and updates will be:

• Released as soon as possible after verification
• Announced in release notes
• Tagged with version numbers following semantic versioning
• Documented with CVE identifiers (if applicable)

To stay updated on security issues:

• Watch this repository for security advisories
• Check the releases page for security patches
• Review commit messages for security-related fixes
• Subscribe to GitHub notifications for this project

ChessReviewEngine is designed with security in mind, but please note:

1. Engine Integration

   • Stockfish engine is executed as a subprocess
   • Engine path can be configured via environment variables
   • Ensure Stockfish binary is from a trusted source

2. WebSocket Connections

   • Real-time analysis uses WebSockets
   • Ensure proper origin validation in production deployments

3. File Processing

   • PGN files are parsed using python-chess library
   • Malformed PGN files should be rejected gracefully

4. API Endpoints

   • No authentication currently implemented
   • Consider adding rate limiting in production
   • CORS is configured for local development

If deploying ChessReviewEngine in production:

• ✅ Enable HTTPS/TLS for all connections
• ✅ Implement authentication and authorization
• ✅ Add rate limiting to prevent abuse
• ✅ Use a reverse proxy (nginx, Apache)
• ✅ Set up monitoring and logging
• ✅ Configure firewall rules appropriately
• ✅ Keep all dependencies updated
• ✅ Run services with minimal privileges
• ✅ Implement request size limits
• ✅ Add input validation middleware

For security concerns or questions about this policy:

• GitHub Issues: For general security questions (non-sensitive)
• Security Advisories: For vulnerability reports
• Project Maintainers: Via GitHub profile contact methods

• OWASP Top 10
• CWE Top 25
• GitHub Security Best Practices
• npm Security Best Practices

Thank you for helping keep ChessReviewEngine secure! 🔐♟️