# Security Policy

`mgf-livepush` is a federation sibling of [`mgf-common`](https://pypi.org/project/mgf-common/),
shipping a realtime push pipeline (SSE streaming, a pluggable
pub/sub broker seam, per-key connection-slot caps). A vulnerability
here may affect every consumer that uses this library for realtime
push, so we take security reports seriously.

## Supported versions

In the 0.x window, **only the latest MINOR receives security
patches.** Per [SemVer 0.x](https://semver.org/#spec-item-4) and
rule **AP-03** from `mgf-standard/docs/standards/API_DESIGN.md`,
each MINOR release MAY break the public API; we do not
branch-and-backport across minors.

| Version | Supported |
|---------|-----------|
| `0.1.x`  | ✅ — latest MINOR; security patches ship as `0.1.Y` |

## Reporting a vulnerability

**Please do not open a public issue or pull request** until we have
had a chance to triage and patch.

- **Email:** `bassam@magogi.org` with subject prefix
  `[mgf-livepush security]`.
- **Codeberg private security advisory:** open a private
  vulnerability report at
  [the repository's Security tab](https://codeberg.org/magogi-admin/mgf-livepush/security).

### What to include

- A description of the vulnerability and its impact.
- Steps to reproduce — a minimal failing test is ideal.
  For slot-cap / connection-exhaustion issues, the exact
  sequence that bypassed the cap matters.
- The version(s) of `mgf-livepush`, `mgf-common`, and
  `redis` affected.
- Python version + OS + Redis version (if applicable).

### What to expect

| Stage | Timeline |
|---|---|
| Acknowledgement | within 3 business days |
| Initial assessment + severity rating | within 7 business days |
| Patch + release | within 30 days for high-severity, 90 days for medium |
| Credit + public disclosure | coordinated with the reporter |

90-day default embargo. After expiry (or after a patch ships),
the vulnerability is disclosed in the [`CHANGELOG.md`](CHANGELOG.md)
entry for the fixing release.

## Scope

**In scope:**

- Code in `src/mgf/livepush/` (the published `mgf-livepush`
  package). Specifically: the `SlotCap` connection cap (the
  fail-open INCR/DECR boundary that bounds per-key fan-out) and
  the broker seam (channel isolation between subscriptions).
- Build / release infrastructure (`pyproject.toml`, the manual
  release flow specified in
  [`mgf-standard/docs/standards/RELEASING.md`](https://codeberg.org/magogi-admin/mgf_common/src/branch/main/docs/standards/RELEASING.md)).

**Out of scope:**

- Vulnerabilities in `mgf-common` itself — report to
  [`mgf-common/SECURITY.md`](https://codeberg.org/magogi-admin/mgf_common/src/branch/main/SECURITY.md).
- Vulnerabilities in `redis`, `fastapi`, or other transitive
  deps — report to the upstream project.
- Proxy misconfiguration on the consumer side (a buffering
  reverse proxy that breaks SSE latency, missing
  `X-Accel-Buffering` passthrough) — that's deployment
  hardening, not library scope.

## Hardening recommendations for consumers

Consumers of `mgf-livepush` adopt the
[`mgf-standard/docs/standards/SECURITY_STANDARD.md`](https://codeberg.org/magogi-admin/mgf_common/src/branch/main/docs/standards/SECURITY_STANDARD.md)
engineering standard as their baseline.

Particular attention paid to:
- **Slot caps on every public stream endpoint.** `SlotCap`
  bounds per-key concurrent connections so a single tenant /
  client cannot exhaust the server's connection budget. Size
  the cap to the actual concurrent-connection profile and pick
  a `slot_key` that maps to your abuse boundary (tenant, user,
  IP) — a too-coarse key lets one actor starve others.
- **Channel scoping.** Derive broker channels from a
  trusted tenant / scope identifier server-side; never let a
  client choose the channel string directly, or it can
  subscribe across tenant boundaries.
- **Proxy buffering + headers.** The proxy-safe response
  headers (`Cache-Control: no-transform`, `X-Accel-Buffering:
  no`) must survive your proxy chain; an intermediary that
  buffers `text/event-stream` both breaks latency and can mask
  back-pressure signals.

## A note on the standards

`mgf-livepush` is a **federation sibling** under the
project-shape taxonomy from
[`mgf-standard/docs/standards/DOCUMENTATION.md`](https://codeberg.org/magogi-admin/mgf_common/src/branch/main/docs/standards/DOCUMENTATION.md) §2.0.
The cross-project engineering standards live in `mgf-common`;
this project inherits them. See
[`docs/standards/README.md`](docs/standards/README.md) for the
pointer.
