# Security & Governance Policy — SyntricDB

At **SyntricDB**, data safety, system integrity, and security transparency are fundamental to our engineering mission. As an enterprise-ready, open-source unified database engine, we maintain rigorous security standards across all layers of our stack.

---

## 1. Governance & Project Sustainability Model

SyntricDB is published as **100% Open Source software under the Apache License 2.0**.

### Sustainability & Bus-Factor Mitigation Strategy
* **Open Source Stewardship**: SyntricDB is built and maintained under open governance standards. All core protocol specifications (PGWire PostgreSQL compatibility, RESP Redis wire protocol, HNSW Vector Search, Raft consensus) are fully open and non-proprietary.
* **No Single Point of Failure (Maintainer Continuity)**: Key architectural specifications, byte-level file format schemas (WAL, segment files, SSTables), and build configurations are fully documented in the public repository to guarantee uninterrupted community stewardship and maintenance.
* **No Cloud Lock-in / Open Specs**: SyntricDB relies entirely on standard open wire protocols (`PGWire v3` port `5432` and `RESP2/RESP3` port `6379`). You retain full control over your infrastructure, binaries, and data files at all times.

---

## 2. Reporting Vulnerabilities

We take security reports very seriously. If you discover a security vulnerability in SyntricDB, please report it directly to our security maintainers rather than opening a public GitHub issue.

### Disclosure Contact & SLA
* **Support & Security Email**: `upendra@syntricdb.com`
* **Response Time SLA**: Acknowledgment within **24 hours**.
* **Triage & Patch Target**: Critical vulnerabilities will receive a triaged assessment within **48 hours** and a security patch release within **72 hours**.
* **GPG Key**: Available upon request for encrypted communications.

### What to Include in a Report
1. Affected SyntricDB version(s) and operational environment (OS, Java runtime version).
2. Proof of Concept (PoC) or step-by-step reproduction steps.
3. Impact assessment (e.g., unauthorized data access, privilege escalation, denial of service).

---

## 3. Data Protection & Security Features

SyntricDB includes native enterprise-grade security primitives built directly into Java 21 LTS runtime:

### Transport Layer Security (TLS 1.3 / SSL)
* Native TLS 1.3 encryption for both **PGWire (5432)** PostgreSQL wire connections and **RESP (6379)** Redis protocol client streams.
* Mutual TLS (mTLS) authentication supported for intra-cluster Raft node replication and CDC streaming pipelines.

### Authentication & Access Control (RBAC)
* Fine-grained Role-Based Access Control (RBAC) supporting read-only, write-only, and administrative scopes across tables, vector indices, and key-value namespaces.
* Support for SCRAM-SHA-256 and MD5 password authentication over PGWire connections.

### SQL Injection & Memory Safety
* Full parameterized query enforcement across SQL parsing layers.
* Pure Java 21 execution environment using Managed Memory & Vector API bounds checking to prevent buffer overflow attacks inherent in standard C/C++ memory models.

---

## 4. Security Audit & Testing Practices

* **Static Analysis**: Continuous automated scanning via GitHub CodeQL and SpotBugs for memory leaks, injection risks, and deadlocks.
* **Dependency Scanning**: Daily automated updates and Dependabot scans monitoring third-party JVM library dependencies.
* **Fuzz Testing**: Continuous protocol fuzzing against standard PGWire and RESP wire implementations to prevent denial-of-service vulnerabilities.

---

## 5. Security Releases & Advisory Bulletins

All security advisories and patch release notes are published to:
* GitHub Security Advisories: `https://github.com/upendra-manike/SyntricDB/security/advisories`
* Security Change Logs: Included in every release tag notes on SyntricDB.com.