# Security Policy

## Supported Versions

We release security updates for the following versions:

| Version | Supported          |
| ------- | ------------------ |
| 1.2.x   | :white_check_mark: |
| 1.1.x   | :white_check_mark: |
| 1.0.x   | :x:                |

## Reporting a Vulnerability

If you discover a security vulnerability within Trilobita DocVault, please send an email to the maintainer. All security vulnerabilities will be promptly addressed.

**Please do not publicly disclose the issue until it has been addressed by the team.**

## Security Measures Implemented

### Input Validation & Sanitization
- All user inputs are sanitized using WordPress sanitization functions
- File uploads are validated against allowed MIME types and extensions
- File sizes are checked against WordPress upload limits
- Nonce verification on all AJAX requests
- Capability checks on all administrative actions

### Output Escaping
- All output is escaped using appropriate WordPress functions (`esc_html`, `esc_attr`, `esc_url`)
- SQL queries use `$wpdb->prepare()` for parameterized queries
- LIKE patterns use `$wpdb->esc_like()` to prevent SQL injection

### File Security
- Files are stored in `/wp-content/uploads/trdv-documents/` with proper permissions
- Download URLs are protected with document ID validation
- File paths use `basename()` to prevent path traversal attacks
- MIME type detection uses `finfo_file()` (PHP 8.1+ compatible)

### Authentication & Authorization
- All admin functions require `edit_posts` or `upload_files` capability
- Document ownership is verified before modifications
- AJAX handlers verify nonces and capabilities

### PHP 8.1+ Compatibility
- Replaced deprecated `mime_content_type()` with `finfo_file()`
- All code tested with PHP 7.4 through 8.2

## Best Practices for Users

1. **Keep WordPress Updated**: Always use the latest version of WordPress
2. **Use Strong Passwords**: Implement strong password policies for admin accounts
3. **Limit Upload Permissions**: Only grant `upload_files` capability to trusted users
4. **Regular Backups**: Maintain regular backups of your document library
5. **Monitor File Uploads**: Review uploaded documents periodically for suspicious content
6. **SSL/TLS**: Use HTTPS to encrypt file uploads and downloads

## Security Changelog

### Version 1.1.0
- Fixed SQL injection vulnerability in duplicate finder
- Added file size validation before upload
- Improved path traversal protection in download handler
- Added capability validation in AJAX handlers
- Replaced deprecated `mime_content_type()` function
- Added comprehensive input validation

## Contact

For security concerns, please contact:
- Website: https://trilobita.co.uk
- GitHub: @trilobita99