james.maes
b76959b455
- Create CHANGELOG.md with v1.0.0 and v0.1.0 entries - Expand SECURITY.md to professional standards (2,130 bytes) - Update RELEASING.md with CHANGELOG management - Bump version to 1.0.0 in Cargo.toml
72 lines
2.1 KiB
Markdown
72 lines
2.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 1.0.x | :white_check_mark: |
|
|
| 0.1.x | :x: |
|
|
|
|
## Reporting A Vulnerability
|
|
|
|
**Do not open a public GitHub issue for security vulnerabilities.**
|
|
|
|
Instead, please use one of the following methods:
|
|
|
|
1. **GitHub Security Advisories**: Create a private security advisory at
|
|
`https://github.com/KofTwentyTwo/notion-sql/security/advisories`
|
|
|
|
2. **PGP Encryption**: If you have the maintainer's PGP public key,
|
|
encrypt your report and send it via email.
|
|
|
|
3. **Disclose to Notion**: If the vulnerability is in the Notion API itself,
|
|
please also report it to Notion's security team at `security@notion.com`.
|
|
|
|
### What To Include
|
|
|
|
- Type of vulnerability (e.g., injection, authentication bypass)
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (if any)
|
|
|
|
### Response Timeline
|
|
|
|
- Acknowledgment: Within 48 hours
|
|
- Status update: Within 7 days
|
|
- Resolution: Within 30 days (or discussion of timeline if complex)
|
|
|
|
## Security Best Practices
|
|
|
|
### Token Handling
|
|
|
|
- Never commit `NOTION_TOKEN` to version control
|
|
- Use environment variables or secure secret management
|
|
- Rotate tokens if they are exposed
|
|
- Use internal integration tokens with minimal required permissions
|
|
|
|
### Rate Limiting
|
|
|
|
The CLI implements automatic rate limiting with retries. To avoid triggering
|
|
rate limits:
|
|
|
|
- Use `--progress` to monitor long-running operations
|
|
- Consider narrowing WHERE clauses to reduce query volume
|
|
- Avoid rapid repeated queries against the same database
|
|
|
|
### API Versioning
|
|
|
|
This release targets Notion API version `2022-06-28`. Future releases may
|
|
migrate to newer API versions with appropriate breaking change handling.
|
|
|
|
## Security Features
|
|
|
|
- TLS 1.3 for all Notion API connections
|
|
- Automatic retry with exponential backoff for rate limits
|
|
- Structured error messages that never expose tokens
|
|
- Dry-run mode to preview mutations before execution
|
|
|
|
## Known Security Considerations
|
|
|
|
- The CLI caches database names in memory for the current session
|
|
- No persistent storage of Notion tokens or data
|