Currently supported versions of this portfolio project:

If you discover a security vulnerability within this project, please follow these steps:

Please do not create a public GitHub issue for security vulnerabilities.

Send an email to: [email protected] with:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested fix (if any)

• Initial response: within 48 hours
• Status update: within 7 days
• Fix timeline: depends on severity

• We will acknowledge your email within 48 hours
• We will confirm the vulnerability and determine its impact
• We will release a fix as soon as possible
• We will credit you in the security advisory (unless you prefer to remain anonymous)

This project follows these security practices:

• Regular updates of dependencies
• Using npm audit to check for vulnerabilities
• Monitoring security advisories

• No sensitive data in repository
• Environment variables for configuration
• Input validation and sanitization
• HTTPS only in production
• Secure headers configuration

• Automated builds with security checks
• Content Security Policy (CSP) headers
• CORS configuration
• Regular security audits

This is a client-side portfolio application. Be aware:

• All client-side code is visible to users
• Never include API keys or secrets in the codebase
• Use environment variables for any sensitive configuration
• Validate all user inputs (contact form, etc.)

This project uses several third-party libraries. We:

• Regularly update dependencies
• Monitor security advisories
• Review dependencies before adding them

Before submitting a PR, please ensure:

• No hardcoded credentials or API keys
• No sensitive data in commits
• Dependencies are up to date
• No known vulnerabilities (npm audit)
• Input validation is implemented
• XSS vulnerabilities are prevented
• External links use rel="noopener noreferrer"

For any security concerns, contact:

• Email: [email protected]
• LinkedIn: linkedin.com/in/sandro-gomez-21355b346

Currently, this project does not have a bug bounty program, but we deeply appreciate responsible disclosure of security issues.

Thank you for helping keep this project secure! 🔒