We release patches for security vulnerabilities for the following versions:

The CloudDB team takes security bugs seriously. We appreciate your efforts to responsibly disclose your findings.

• Open a public GitHub issue for security vulnerabilities
• Disclose the vulnerability publicly before we've had a chance to address it

1. Email us privately at security@clouddb.com with:

   • A description of the vulnerability
   • Steps to reproduce the issue
   • Possible impacts
   • Suggestions for how to fix it (if any)

2. Give us reasonable time to investigate and fix the issue before public disclosure

3. Do not exploit the vulnerability beyond what's necessary to demonstrate it

• Acknowledgment: We'll acknowledge receipt of your report within 48 hours
• Communication: We'll keep you informed about our progress
• Timeline: We aim to address critical issues within 7 days
• Credit: We'll credit you in our security advisories (unless you prefer to remain anonymous)

• Never commit .env.local or .env files to version control
• Use strong, unique passwords for database connections
• Rotate API keys regularly
• Use environment-specific credentials (dev, staging, production)

• Always use encrypted connections (SSL/TLS) for production databases
• Use read-only credentials when possible
• Implement IP whitelisting for database access
• Never store database credentials in client-side code

• Enable two-factor authentication (2FA) in Clerk
• Regularly review user access and permissions
• Implement session timeout policies
• Monitor for suspicious login attempts

• Always validate and sanitize user inputs
• Implement rate limiting on API endpoints
• Use HTTPS only in production
• Keep dependencies up to date

• Encrypt sensitive data at rest
• Use secure methods for data transmission
• Regularly backup your data
• Implement access controls and audit logs

CloudDB stores database connection credentials. We recommend:

• Using connection strings instead of individual credentials when possible
• Encrypting sensitive fields in your MongoDB instance
• Implementing additional encryption layers for production use
• Regular security audits of stored credentials

We regularly update our dependencies to address known vulnerabilities. You can check for security issues by running:

npm audit

Security updates will be released as patch versions. Please subscribe to our GitHub releases to stay informed.

CloudDB aims to comply with:

• GDPR (General Data Protection Regulation)
• SOC 2 Type II (for Enterprise tier)
• Industry-standard security practices

We're currently considering implementing a bug bounty program. Stay tuned for updates.

For security-related questions or concerns, contact us at:

• Email: security@clouddb.com
• PGP Key: [Link to PGP key if available]

We'd like to thank the following security researchers for responsibly disclosing vulnerabilities:

• Your name could be here!

Last updated: February 9, 2026