Kuwala takes the security and integrity of its codebase and user data seriously.
Security updates are actively provided for the following versions:
| Version | Supported | Notes |
|---|---|---|
| 0.1.x | ✅ | Active Release Line |
| < 0.1.0 | ❌ | Pre-release / Deprecated |
If you discover a security vulnerability or potential credential exposure within Kuwala:
- Do NOT open a public issue on GitHub.
- Email the security team:
security@kuwala.org(or submit a Private Vulnerability Advisory via GitHub Security Advisories). - Include the following details:
- Description of the vulnerability or flaw.
- Steps to reproduce or proof-of-concept script.
- Potential impact on users or systems.
- Initial Response: Within 48 hours.
- Triage & Patch: Within 7 business days for critical issues.
- Public Disclosure: Coordinated disclosure after a patch is released to PyPI.
- API Keys & Tokens: Always load credentials via environment variables (
.env). Never commit credentials to source control. - Data Protection: Kuwala runs strictly client-side. No telemetry, market data, or user trading signals are transmitted to external servers.