Skip to content

Security: makr-code/ThemisDB

Security

SECURITY.md

🔐 Security Policy

ThemisDB Security Team

Security Score Gitleaks Responsible Disclosure

📋 Supported Versions

Important

ThemisDB is actively maintained. Security updates are provided for supported versions only.

Version Status Security Updates End of Life
1.x ✅ Active ✅ Yes TBD
0.9.x ✅ Maintenance ✅ Yes 2026-12-31
< 0.9 ❌ Unsupported ❌ No 2024-01-01

🚨 Reporting a Vulnerability

We take security vulnerabilities seriously. If you discover a security issue, please follow our responsible disclosure process.

❌ Do NOT

Caution

Never do these things:

  • ❌ Open a public GitHub issue for security vulnerabilities
  • ❌ Discuss the vulnerability publicly before it's addressed
  • ❌ Exploit the vulnerability beyond demonstration purposes

✅ Do

1️⃣ Report via GitHub Security Advisories (Recommended)
  1. Go to Security Advisories
  2. Create a new private security advisory
  3. Include:
    • 📝 Description of the vulnerability
    • 🔄 Steps to reproduce the issue
    • 💥 Potential impact assessment
    • 🛠️ Suggested fixes (optional)
2️⃣ Use Responsible Disclosure
  • ⏳ Give us reasonable time to address the issue
  • 🤐 No public disclosure before fix is released
  • 🤝 Coordinate disclosure timeline with security team
3️⃣ Provide Sufficient Detail

Help us reproduce and verify the issue:

  • 🖥️ Environment details (OS, version, configuration)
  • 📊 Proof-of-concept (PoC) code or steps
  • 📸 Screenshots or logs (if applicable)

Response Timeline

Timeframe Action Status
Within 24 hours Acknowledgment of your report 📨
Within 72 hours Initial assessment & severity classification 🔍
7-14 days Detailed response with remediation plan 📋
30-90 days Fix released (depending on severity/complexity) 🚀

Note

Critical vulnerabilities are prioritized and may receive expedited fixes within 7 days.

🛡️ Security Measures

ThemisDB implements defense-in-depth security across all layers:

🔑 Authentication & Authorization
  • ✅ RBAC (Role-Based Access Control) with 4-tier hierarchy
  • ✅ mTLS (Mutual TLS) for client authentication
  • ✅ Token-based API authentication
  • ✅ HashiCorp Vault integration for secrets management

Security Level: ⭐⭐⭐⭐⭐

🌐 Network Protocol Security (v1.3.0+)
Protocol Security Features TLS Version
HTTP/2 Server Push, TLS 1.3 required 1.3+
WebSocket WSS (WebSocket Secure) 1.2+
MQTT TLS/mTLS support, auth required 1.2+
PostgreSQL Wire SSL/TLS encryption, RBAC 1.2+
MCP Server Transport security (stdio/SSE/WS) 1.2+

[!IMPORTANT] All protocols require explicit opt-in build switches for production readiness.

🔒 Encryption

Data-at-Rest:

  • 🔐 AES-256-GCM encryption
  • 🗄️ Field-Level Encryption (schema-based selective encryption)
  • 🔑 Key Management: HSM (PKCS#11), Vault, or Mock providers

Data-in-Transit:

  • 🌐 TLS 1.3 (with TLS 1.2 fallback)
  • 🔗 Perfect Forward Secrecy (PFS)
  • 📜 Certificate pinning for HSM/TSA
✅ Input Validation
  • 📋 JSON Schema validation
  • 💉 AQL injection prevention
  • 🚫 Path traversal protection
  • 📦 Request body size limits (10MB default)
🚦 Rate Limiting & DoS Protection
  • ⏱️ Token bucket algorithm (100 req/min default)
  • 🌍 Per-IP rate limiting
  • 👤 Per-user rate limiting
  • ⚙️ Configurable thresholds
📊 Audit & Compliance

Audit Logging:

  • 📝 65+ security event types
  • 🔐 Encrypt-then-Sign audit logs
  • 🔗 Hash chain for tamper detection
  • 🔔 SIEM integration (Syslog RFC 5424, Splunk HEC)

Compliance Ready:

  • ✅ GDPR/DSGVO
  • ✅ eIDAS
  • ✅ SOC 2
  • ✅ HIPAA

🔒 Security Hardening

Important

For production deployments, follow our Security Hardening Guide.

Hardening Checklist

Step Action Priority
1️⃣ Enable TLS with strong cipher suites 🔴 Critical
2️⃣ Configure RBAC with least-privilege principle 🔴 Critical
3️⃣ Enable audit logging with encryption 🟡 High
4️⃣ Use external key management (Vault/HSM) 🟡 High
5️⃣ Configure rate limiting appropriately 🟢 Medium
6️⃣ Set up monitoring and alerting 🟢 Medium
7️⃣ Regular security updates and patching 🔴 Critical

📚 Security Documentation

Core Security Guides
Advanced Security Topics

🤝 Vulnerability Disclosure Policy

We follow responsible disclosure practices:

1️⃣ Acknowledgment

Security researchers who responsibly disclose vulnerabilities will be acknowledged in our security advisories (unless they prefer to remain anonymous).

2️⃣ No Legal Action

We will not take legal action against security researchers who:

  • ✅ Act in good faith
  • ✅ Follow this security policy
  • ✅ Do not access or modify other users' data
  • ✅ Do not disrupt our services
3️⃣ CVE Coordination

For significant vulnerabilities, we will coordinate CVE assignment with MITRE.

🔍 Security Scanning

Automated security scanning is integrated into our CI/CD pipeline.

Tools

Tool Purpose Integration
Gitleaks Secret detection in source code ✅ CI/CD
clang-tidy Static analysis for C++ code ✅ CI/CD
cppcheck Additional C++ security checks ✅ CI/CD
Trivy Container image vulnerability scanning ✅ CI/CD
OWASP ZAP Dynamic application security testing 🚧 Planned

Run Scans Locally

Windows (PowerShell) 
.\security-scan.ps1
Linux/WSL 
# If the script exists
./security-scan.ps1

# Or use tools directly:
gitleaks detect --source . --verbose
cppcheck --enable=warning,style --inconclusive ./src ./include

📞 Security Contact

Method Purpose Link
🔒 GitHub Security Advisories Report vulnerabilities (Recommended) Report
💬 GitHub Issues Non-sensitive security discussions Issues
🔑 PGP Key Encrypted communications Available upon request

Note

Response Time: Within 24 hours for initial acknowledgment.

📅 Changelog

Date Event
2025-11 📝 Initial security policy publication

🔐 Security is a top priority at ThemisDB

🚨 Report a Vulnerability · 📖 Security Docs · 🛡️ Hardening Guide

There aren’t any published security advisories