Skip to main content
Version: Next 🚧

Security Policy

Reporting a Vulnerability​

If you discover a security vulnerability in jGuard, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

How to Report​

Email security concerns to: security@jguard.io

Please include:

  • Description of the vulnerability
  • Steps to reproduce
  • Affected versions
  • Potential impact
  • Any suggested fixes (optional)

What to Expect​

TimeframeAction
24-48 hoursInitial acknowledgment
7 daysAssessment and severity classification
30-90 daysFix development and testing
After fixCoordinated disclosure

Disclosure Policy​

We follow coordinated disclosure:

  1. Reporter contacts us privately
  2. We assess and develop a fix
  3. We release a patched version
  4. We publish a security advisory
  5. Reporter may publish details after advisory

Security Advisories​

Security advisories are published on:

Scope​

The following are in scope:

  • jGuard agent (jguard-agent)
  • Policy compiler (jguard-policy)
  • CLI tools (jguard-cli)
  • Gradle plugin (io.jguard.policy)

Out of scope:

  • This documentation website
  • Third-party dependencies (report to their maintainers)

Recognition​

We appreciate security researchers who help keep jGuard secure. With your permission, we'll acknowledge your contribution in the security advisory.

Security Best Practices​

When using jGuard in production:

  1. Sign your JARs - Enable policy verification
  2. Disable unsigned policies - Set allowUnsignedPolicies = false
  3. Use strict mode - Set mode = "strict"
  4. Review policies - Audit all entitlements before deployment
  5. Protect policy directories - Restrict write access to external policies
  6. Monitor violations - Enable logging with jguard.log.denied=true