# Security Policy

**Effective date:** 2026-07-28  
**Contact:** hello@doggybagg.cc  
**Canonical:** https://sqlguard.io/security · https://sqlguard.io/.well-known/security.txt

## Supported versions

| Version | Supported |
|---------|-----------|
| 1.x (`master` / production Fly `sqlguard-io`) | Yes |

## Reporting a vulnerability

Email **hello@doggybagg.cc** with subject `SECURITY:` and include:

- description and impact
- reproduction steps / PoC (**non-destructive** preferred)
- affected URL, host, or commit
- your contact for coordination

Please **do not** open a public GitHub issue for undisclosed vulnerabilities. Do **not** access other customers’ data, destroy data, or perform high-volume DoS.

We aim to **acknowledge within 72 hours** and provide a remediation timeline after triage.

## Scope

**In scope:** SQLGuard HTTP/MCP APIs on production hosts (`sqlguard.io`, `sqlguard-io.fly.dev`), certificate issuance/verification, credit/payment enforcement, Session/BIND/GATE logic, authz fail-closed paths.

**Out of scope:** third-party facilitators, blockchain consensus bugs, social engineering of unrelated accounts, physical attacks, spam, and DoS via enormous legitimate paid traffic without prior coordination.

## Safe harbor

Good-faith research that avoids privacy violations, data destruction, and service disruption, and that promptly reports findings, is appreciated and will **not** be treated as an AUP/Terms violation solely for that research.

## Hardening posture (public)

- TLS terminated at the edge; Helmet CSP / frame denial on app responses
- Rate limits on public HTTP
- Ed25519 attestations; demo sandbox rejected in production verify unless explicitly allowed
- Public executor fail-closed by default
- Secrets never committed (`keys/`, `.env*`); ephemeral host FS is not the money ledger

## Contact

hello@doggybagg.cc  
`https://sqlguard.io/.well-known/security.txt`