We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:

Please report (suspected) security vulnerabilities to security@liquidplatform.dev. You will receive a response within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.

When reporting a security vulnerability, please include:

• Description - A clear description of the vulnerability
• Impact - What could an attacker do with this vulnerability?
• Steps to Reproduce - Detailed steps to reproduce the issue
• Proof of Concept - If possible, include a proof of concept
• Suggested Fix - If you have ideas on how to fix it

• Do NOT include sensitive data (API keys, passwords, tokens)
• Do NOT include exploits that could harm users
• Do NOT publicly disclose the vulnerability until we've had time to address it

• Keep dependencies updated - Regularly update your dependencies
• Use environment variables - Never commit secrets or API keys
• Enable authentication - Always use JWT authentication in production
• Use HTTPS - Always use HTTPS in production
• Regular backups - Keep regular backups of your database

• Never commit secrets - Use environment variables
• Use parameterized queries - Prevent SQL injection
• Validate inputs - Always validate user inputs with Zod
• Follow security guidelines - Read our security documentation
• Report vulnerabilities - If you find a vulnerability, report it privately

Liquid Platform includes several security features:

• ✅ JWT Authentication - Secure token-based authentication
• ✅ Input Validation - Zod schemas for all inputs
• ✅ SQL Injection Prevention - Parameterized queries only
• ✅ CORS Protection - Configured CORS middleware
• ✅ Rate Limiting - API rate limiting to prevent abuse
• ✅ Environment Variables - Secrets stored in environment variables
• ✅ Helmet.js - Security headers middleware
• ✅ Password Hashing - bcrypt for password hashing

• Google AI API Key - Required for AI functionality
• Database URL - Contains database credentials
• JWT Secret - Used for token signing

Never commit these to version control!

• Use parameterized queries (already enforced)
• Enable SSL for production databases
• Use strong passwords
• Limit database access to necessary IPs

• JWT tokens expire after 7 days
• Tokens are signed with a secret key
• Passwords are hashed with bcrypt

We regularly update dependencies to patch security vulnerabilities. Check CHANGELOG.md for security-related updates.

We follow responsible disclosure practices:

1. Report privately - Report vulnerabilities to security@liquidplatform.dev
2. Wait for response - We'll respond within 48 hours
3. Allow time to fix - We'll work on a fix and keep you updated
4. Coordinate disclosure - We'll coordinate public disclosure after a fix is released

We thank the security researchers who help keep Liquid Platform secure. Contributors who report valid security vulnerabilities will be acknowledged (if they wish) in our security acknowledgments.

Last Updated: January 2026