SECURITY.md

Rama main · réplica de lectura del repositorio original.

# Security Policy

## Supported Versions

We actively support and patch security vulnerabilities on the following versions of **Twenty CRM Client Portal**:

| Version | Supported          |
| ------- | ------------------ |
| 2.1.x   | :white_check_mark: |
| 2.0.x   | :white_check_mark: |
| 1.5.x   | :x:                |
| 1.4.x   | :x:                |
| 1.3.x   | :x:                |
| 1.2.x   | :x:                |
| 1.1.x   | :x:                |
| 1.0.x   | :x:                |
| < 1.0.0 | :x:                |

Please ensure you are always running the latest minor and patch releases to keep your deployment secure.

## Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it to us privately. **Please do not open public issues, pull requests, or discussions on GitHub regarding potential vulnerabilities.**

### How to Report

Please email your report to **remark@remark.rip**.

To help us investigate and resolve the issue as quickly as possible, please include:
- A clear description of the vulnerability.
- Step-by-step instructions or a proof-of-concept (PoC) script to reproduce the issue.
- Setup details (such as whether this was observed in a Docker Compose environment or local development).
- The potential security impact (e.g., data disclosure, authorization bypass, privilege escalation).
- Any proposed fixes or code adjustments if available.

### Disclosure Process

1. **Acknowledgment**: We will acknowledge receipt of your report within 48 hours.
2. **Evaluation & Triage**: We will investigate the report and verify the vulnerability. We may contact you for further details.
3. **Patching**: Once verified, we will develop a patch and apply it to our active release branches.
4. **Release**: We will release the patched version and document the fix in our [CHANGELOG.md](CHANGELOG.md).
5. **Attribution**: We will gladly credit you for the responsible disclosure in our release notes unless you prefer to remain anonymous.

Thank you for helping to keep this project secure!