We actively support the following versions of FactCheckAI:
| Version | Supported |
|---|---|
| 2.6.x | ✅ Active support |
| 2.5.x | ✅ Security fixes |
| 2.4.x | ❌ End of life |
| < 2.4 | ❌ End of life |
We take security seriously. If you discover a security vulnerability, please follow these guidelines:
DO NOT create a public GitHub issue for security vulnerabilities.
Instead, please email us directly at: security@factcheckai.com
Please include the following information:
- Vulnerability Type: (e.g., XSS, SQL Injection, Authentication bypass)
- Affected Component: (Backend API, Chrome Extension, Database)
- Steps to Reproduce: Detailed reproduction steps
- Impact Assessment: Potential security impact
- Suggested Fix: If you have ideas for remediation
- Contact Information: So we can follow up with questions
We commit to the following response times:
| Severity | Initial Response | Status Update | Fix Timeline |
|---|---|---|---|
| Critical | 24 hours | Every 48 hours | 7 days |
| High | 48 hours | Weekly | 14 days |
| Medium | 5 days | Bi-weekly | 30 days |
| Low | 10 days | Monthly | 90 days |
- Encryption: All data in transit uses TLS 1.3+
- Authentication: JWT tokens with automatic rotation
- Authorization: Role-based access control (RBAC)
- Data Anonymization: Personal data is automatically anonymized
- Multi-Cloud: Distributed across multiple cloud providers
- Rate Limiting: API endpoints protected against abuse
- DDoS Protection: Cloudflare enterprise protection
- Monitoring: 24/7 security monitoring with automated alerts
- Static Analysis: Automated security scanning with Bandit
- Dependency Scanning: Continuous vulnerability monitoring
- Secret Scanning: No secrets in source code
- Code Review: All changes reviewed by security-trained developers
We perform regular security assessments:
- SAST: Static Application Security Testing on every commit
- DAST: Dynamic testing against running applications
- Dependency Scanning: Third-party library vulnerability checks
- Container Scanning: Docker image security analysis
- Penetration Testing: Quarterly external security audits
- Code Review: Security-focused code reviews
- Red Team Exercises: Internal attack simulations
- Bug Bounty: Community-driven vulnerability discovery
We run a responsible disclosure program with the following rewards:
| Severity | Reward Range | Examples |
|---|---|---|
| Critical | $1,000 - $5,000 | Remote code execution, full system compromise |
| High | $500 - $1,000 | Authentication bypass, privilege escalation |
| Medium | $100 - $500 | XSS, CSRF, information disclosure |
| Low | $50 - $100 | Minor security improvements |
- Vulnerability affects a supported version
- Previously unreported security issue
- Follows responsible disclosure guidelines
- No malicious testing or data extraction
- Testing limited to your own accounts
- Keep Updated: Always use the latest version
- Strong Passwords: Use unique, complex passwords
- Two-Factor Authentication: Enable 2FA when available
- Suspicious Activity: Report unusual behavior immediately
- Environment Variables: Never commit secrets to version control
- Input Validation: Sanitize and validate all user inputs
- Least Privilege: Use minimal necessary permissions
- Security Headers: Implement appropriate HTTP security headers
- API Keys: Rotate API keys regularly
- Network Security: Use VPNs and network segmentation
- Access Reviews: Regularly audit user access and permissions
- Incident Response: Have a security incident response plan
We maintain compliance with industry standards:
- SOC 2 Type II (in progress)
- GDPR Compliance (EU data protection)
- CCPA Compliance (California privacy rights)
- ISO 27001 (Information security management)
- HIPAA (Healthcare data protection)
- FedRAMP (US government cloud security)
We track and publicly report security metrics:
- Mean Time to Detection (MTTD): < 4 hours
- Mean Time to Response (MTTR): < 24 hours
- Mean Time to Resolution (MTTR): < 7 days (critical)
- Security Score: 95/100 (SecurityScorecard)
- Vulnerability Density: < 1 per 10K lines of code
- Patch Coverage: 100% of critical vulnerabilities
- Email: security@factcheckai.com
- PGP Key: Download public key
- Response Time: 24 hours for critical issues
- Documentation: https://docs.factcheckai.com/security
- Status Page: https://status.factcheckai.com
- Security Blog: https://blog.factcheckai.com/security
By participating in our security program, you agree to:
- Legal Authorization: Only test on systems you own or have explicit permission to test
- No Harmful Actions: Do not access, modify, or delete user data
- Confidentiality: Keep vulnerability details confidential until publicly disclosed
- Good Faith: Act in good faith to avoid privacy violations and service disruptions
We commit to:
- No Legal Action: Not pursue legal action against security researchers who follow these guidelines
- Acknowledgment: Public recognition for valid security reports (unless requested otherwise)
- Safe Harbor: Protection under our coordinated disclosure policy
Last Updated: January 2027
Next Review: April 2027