At REZ LAB, we take security seriously and are committed to protecting our users and community. We appreciate the security research community and follow responsible disclosure practices to ensure the safety of our users while giving researchers appropriate credit for their findings.

Note: We recommend always using the latest stable version for the best security coverage.

If you discover a security vulnerability, please do NOT create a public issue on GitHub. Instead, follow our secure reporting process:

• Primary Contact: work.rezaul@outlook.com
• Response Time: Within 48 hours
• Encryption: PGP/GPG support available upon request

Please provide as much detail as possible to help us understand and address the issue:

• 🔍 Vulnerability Type: (e.g., XSS, CSRF, Authentication Bypass, etc.)
• 📍 Location: File name, function, or specific code section
• 💥 Impact Assessment: Potential consequences and affected users
• 🔄 Reproduction Steps: Clear instructions to reproduce the issue
• 🛠️ Suggested Fix: Your recommended solution (if available)
• 🔧 Environment Details: OS, Python version, dependencies used

• ❌ Do not exploit the vulnerability for malicious purposes
• ❌ Do not share details publicly until coordinated disclosure
• ❌ Do not attempt to access unauthorized systems or data

1. 📥 Acknowledgment - Confirm receipt within 48 hours
2. 🔍 Triage - Assess severity and impact
3. 🔬 Investigation - Technical analysis and reproduction
4. 🛠️ Fix Development - Create and test security patches
5. ✅ Validation - Verify fix effectiveness
6. 📢 Disclosure - Coordinated public announcement

We maintain a Security Researcher Hall of Fame to recognize researchers who help improve our security:

• Public acknowledgment in release notes
• Credit in security advisories
• Invitations to private beta programs
• Potential bounties for critical findings

• Reports must follow responsible disclosure practices
• Clear, actionable reports receive priority attention
• Collaborative attitude appreciated during fix development

• Keep your software updated to the latest version
• Use strong, unique passwords for proxy authentication
• Regularly review and audit proxy configurations
• Monitor proxy logs for suspicious activity

• Follow secure coding practices
• Implement proper input validation
• Use encryption for sensitive data
• Regular security code reviews

• Test in safe, isolated environments
• Document findings thoroughly
• Allow reasonable time for fixes before disclosure
• Respect user privacy and data protection

• GitHub Issues: For non-security related bugs and features
• General Support: For usage questions and general help
• Emergency: For active exploitation, contact immediately

• 📖 Contributing Guide - How to contribute to the project
• 🤝 Code of Conduct - Community guidelines
• 📋 Usage Guide - How to use Poxy CLI safely

This security policy is maintained and updated regularly to reflect our current practices and response capabilities.