We provide security updates for the following versions of ContextSync:

If you discover a security vulnerability in ContextSync, please do not open a public issue. Instead, report it privately using one of the following channels:

1. GitHub Private Security Advisory (preferred): Report a vulnerability
2. Email: security@contextsync.dev

• 48 hours: We will acknowledge receipt of your report
• 7 days: Initial assessment and security impact classification
• 30 days: Target timeline for patch development and release

When reporting a vulnerability, please provide:

1. Description — A clear explanation of the vulnerability
2. Steps to Reproduce — Detailed steps to reproduce the issue
3. Affected Versions — Which version(s) of ContextSync are affected
4. Potential Impact — The severity and potential consequences of the vulnerability
5. Proof of Concept — If possible, include a minimal example or code snippet

The more details you provide, the faster we can assess and address the issue.

We follow a coordinated disclosure process:

1. You report the vulnerability privately
2. We investigate and develop a fix
3. We release a security patch
4. We publicly disclose the vulnerability and credit the reporter (if desired)

We will not publicly disclose the vulnerability until a fix is available and released. This gives users time to update and protects the community from active exploitation.

When using ContextSync:

• Keep your installation updated to the latest version
• Use strong, unique passwords for all accounts
• Enable authentication and authorization features
• Regularly review access logs and activity
• Use HTTPS in production environments
• Keep your environment variables and secrets secure

For security inquiries, contact: security@contextsync.dev