Security updates are provided for supported release branches.

Users are encouraged to upgrade to the latest supported release to receive the latest security fixes and improvements.

If you believe you have discovered a security vulnerability in Duck Framework, please report it responsibly.

Please do not disclose the vulnerability publicly before it has been investigated and, where appropriate, fixed.

Submit a private report through GitHub Security Advisories:

https://github.com/duckframework/duck/security/advisories

If you are unable to use GitHub Security Advisories, email:

hello@duckframework.com

Please include:

• A clear description of the vulnerability
• Steps to reproduce the issue
• The affected version(s)
• The potential impact
• Any proof-of-concept or example exploit (if available)

Providing detailed information helps us investigate and resolve issues more quickly.

Our goal is to:

• Acknowledge reports within 48 hours
• Perform an initial assessment within 7 days
• Keep you informed throughout the investigation
• Develop and release a fix or mitigation as quickly as reasonably possible
• Publish a security advisory after a fix is available, coordinating disclosure with the reporter whenever practical

Response times are goals rather than guarantees and may vary depending on the severity and complexity of the report.

Security fixes may be released as:

• Patch releases
• Hotfix releases
• Mitigations or documented workarounds when an immediate fix is not possible

Security advisories will be published through GitHub when appropriate.

To help keep your deployment secure, we recommend:

• Running the latest supported version of Duck Framework
• Enabling HTTPS for production deployments
• Keeping dependencies up to date
• Restricting access to administrative interfaces and sensitive endpoints
• Using strong authentication and secure secret management
• Following the principle of least privilege
• Monitoring application and server logs
• Using a Web Application Firewall (WAF) where appropriate

Thank you for helping keep Duck Framework secure. We appreciate responsible disclosure and the contributions of the security community.