We release patches for security vulnerabilities for the following versions:

We take the security of CloudWeGo Template seriously. If you have discovered a security vulnerability, we appreciate your help in disclosing it to us in a responsible manner.

• Open a public GitHub issue
• Disclose the vulnerability publicly
• Exploit the vulnerability

Report security vulnerabilities to:

📧 Email: security@example.com

Or create a private security advisory on GitHub: https://github.com/yi-nology/cloudwego-template/security/advisories/new

Please include the following information in your report:

1. Description of the vulnerability
2. Steps to reproduce the issue
3. Possible impact of the vulnerability
4. Suggested fix (if any)
5. Your name/handle (optional, for credit)

• ⏱️ We will acknowledge receipt of your report within 48 hours
• 🔍 We will investigate and provide an initial assessment within 7 days
• 🛠️ We will release a fix as soon as possible, depending on complexity
• 📢 We will publicly disclose the issue after the fix is released
• 🙏 We will credit you in our security advisories (unless you prefer to remain anonymous)

When using CloudWeGo Template:

1. Keep dependencies up to date

   go mod tidy
   go get -u

2. Use environment variables for sensitive data

   database:
     password: "${DB_PASSWORD}"
   redis:
     password: "${REDIS_PASSWORD}"

3. Enable security scanning

   go install github.com/securego/gosec/v2/cmd/gosec@latest
   gosec ./...

4. Review configuration files

   • Never commit secrets to version control
   • Use .gitignore for sensitive files

5. Keep Go version updated

   # Check for updates
   go version

No known security vulnerabilities in the current version.

Security updates will be announced via:

• GitHub Security Advisories
• GitHub Releases
• CHANGELOG.md

For general security questions:

• 💬 GitHub Discussions
• 📧 Email: security@example.com

Thank you for helping keep CloudWeGo Template secure! 🔒