We actively support the following versions of the Go Pip SDK:

We take the security of the Go Pip SDK seriously. If you discover a security vulnerability, please follow these steps:

Please do not create a public GitHub issue for security vulnerabilities. This could put users at risk.

Send an email to [email protected] with the following information:

• A clear description of the vulnerability
• Steps to reproduce the issue
• Potential impact of the vulnerability
• Any suggested fixes or mitigations
• Your contact information for follow-up

We will acknowledge receipt of your vulnerability report within 48 hours and provide a detailed response within 7 days indicating:

• Confirmation of the vulnerability
• Our assessment of the impact
• Timeline for a fix
• Any immediate mitigation steps

We follow a coordinated disclosure process:

1. We will work with you to understand and validate the vulnerability
2. We will develop and test a fix
3. We will prepare a security advisory
4. We will release the fix and publish the advisory
5. We will credit you for the discovery (if desired)

When using the Go Pip SDK, please follow these security best practices:

• Regularly update the SDK to the latest version
• Monitor security advisories for dependencies
• Use tools like go mod tidy and go list -m -u all to check for updates

• Always validate package names and versions before installation
• Sanitize user input when constructing package specifications
• Use version constraints to prevent unexpected package versions

• Configure trusted package indexes in your pip configuration
• Avoid installing packages from untrusted sources
• Verify package integrity when possible

• Use virtual environments to isolate package installations
• Avoid installing packages globally when possible
• Clean up virtual environments when no longer needed

• Enable appropriate logging levels for your environment
• Monitor pip operations for suspicious activity
• Review logs regularly for security events

• Use HTTPS for package downloads
• Configure appropriate proxy settings if required
• Validate SSL certificates for package indexes

// Good: Validate package names
func installPackage(name string) error {
    if !isValidPackageName(name) {
        return errors.New("invalid package name")
    }
    
    pkg := &pip.PackageSpec{
        Name: name,
        // Use version constraints
        Version: ">=1.0.0,<2.0.0",
    }
    
    return manager.InstallPackage(pkg)
}

// Bad: Direct user input without validation
func installPackageUnsafe(userInput string) error {
    pkg := &pip.PackageSpec{Name: userInput}
    return manager.InstallPackage(pkg)
}

// Good: Validate paths
func createVenv(path string) error {
    cleanPath := filepath.Clean(path)
    if !isValidPath(cleanPath) {
        return errors.New("invalid path")
    }
    
    return manager.CreateVenv(cleanPath)
}

// Bad: Direct path usage without validation
func createVenvUnsafe(userPath string) error {
    return manager.CreateVenv(userPath)
}

// Good: Secure configuration
config := &pip.Config{
    DefaultIndex: "https://pypi.org/simple/",
    TrustedHosts: []string{"pypi.org", "pypi.python.org"},
    Timeout:      30 * time.Second,
    Environment: map[string]string{
        "PIP_DISABLE_PIP_VERSION_CHECK": "1",
    },
}

// Bad: Insecure configuration
config := &pip.Config{
    DefaultIndex: "http://untrusted-index.com/simple/",
    // No trusted hosts specified
    // No timeout specified
}

We will maintain a record of disclosed vulnerabilities here:

• No vulnerabilities have been disclosed to date.

We use the following tools to maintain security:

• Dependabot: Automated dependency updates
• CodeQL: Static analysis for security vulnerabilities
• gosec: Go security checker
• nancy: Vulnerability scanner for Go dependencies

For security-related questions or concerns:

• Email: [email protected]
• For general questions: GitHub Discussions

We appreciate the security research community and will acknowledge researchers who responsibly disclose vulnerabilities to us.

Thank you for helping keep the Go Pip SDK and its users safe!