We actively support the following versions of Git Axiom with security updates:

We take security seriously at Git Axiom. If you discover a security vulnerability, please follow these steps:

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report security vulnerabilities by email to:

• Email: aliabdiyev000@gmail.com
• Subject: [SECURITY] Git Axiom Security Vulnerability

When reporting a vulnerability, please include:

1. Description - A clear description of the vulnerability
2. Impact - What an attacker could achieve by exploiting this vulnerability
3. Reproduction - Steps to reproduce the vulnerability
4. Affected Versions - Which versions of Git Axiom are affected
5. Suggested Fix - If you have ideas on how to fix it (optional)

• Acknowledgment: We will acknowledge receipt of your vulnerability report within 48 hours
• Initial Assessment: We will provide an initial assessment within 72 hours
• Status Updates: We will send status updates every 5 business days until resolution
• Resolution: We aim to resolve critical vulnerabilities within 7 days

Git Axiom implements several security measures:

• API Key Security: OpenAI API keys are only read from environment variables
• Input Validation: All user inputs are validated and sanitized
• Dependency Scanning: Regular dependency updates and vulnerability scanning
• Code Analysis: Automated code security analysis via CodeQL
• Minimal Permissions: The CLI requests only necessary system permissions

When using Git Axiom:

1. API Key Management

   • Store your OpenAI API key securely in environment variables
   • Never commit API keys to version control
   • Rotate API keys regularly

2. Repository Security

   • Only run Git Axiom in trusted repositories
   • Review generated commit messages before confirming
   • Be aware of sensitive information in your code changes

3. Network Security

   • Ensure you're using HTTPS when possible
   • Be cautious when using on public networks

We appreciate security researchers who help keep Git Axiom secure. Contributors who report valid security vulnerabilities will be:

• Acknowledged in our security advisories (if desired)
• Listed in our README contributors section
• Invited to test future security improvements

For any security-related questions or concerns:

• Email: aliabdiyev000@gmail.com
• GitHub: @Abdiev003

Thank you for helping keep Git Axiom and our community safe! 🛡️