Skip to content

Commit ebec446

Browse files
author
Nipuna Perera
authored
Merge pull request #3 from nipunap/nipuna/add-ci
fix: releases and security policy fixed
2 parents 2796795 + 9459811 commit ebec446

File tree

2 files changed

+140
-11
lines changed

2 files changed

+140
-11
lines changed

‎.github/workflows/release.yml‎

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -56,16 +56,22 @@ jobs:
5656
exit 0
5757
fi
5858
59-
# Get commits since last tag
60-
COMMITS=$(git log ${LAST_TAG}..HEAD --oneline)
61-
62-
if [ -z "$COMMITS" ]; then
63-
echo "No new commits since last tag"
64-
echo "should_release=false" >> $GITHUB_OUTPUT
65-
exit 0
59+
# Get commits since last tag or all commits if no tags exist
60+
if git describe --tags --abbrev=0 >/dev/null 2>&1; then
61+
# There are existing tags
62+
COMMITS=$(git log ${LAST_TAG}..HEAD --oneline)
63+
if [ -z "$COMMITS" ]; then
64+
echo "No new commits since last tag"
65+
echo "should_release=false" >> $GITHUB_OUTPUT
66+
exit 0
67+
fi
68+
echo "New commits since $LAST_TAG:"
69+
else
70+
# No existing tags, get all commits
71+
COMMITS=$(git log --oneline)
72+
echo "No existing tags found. All commits:"
6673
fi
6774
68-
echo "New commits since $LAST_TAG:"
6975
echo "$COMMITS"
7076
7177
# Determine version bump based on commit messages
@@ -172,12 +178,24 @@ jobs:
172178
173179
EOF
174180
175-
# Get commits since last tag
176-
git log ${LAST_TAG}..HEAD --pretty=format:"- %s (%h)" >> $CHANGELOG_FILE
181+
# Get commits since last tag or all commits if no tags exist
182+
if git describe --tags --abbrev=0 >/dev/null 2>&1; then
183+
# There are existing tags
184+
git log ${LAST_TAG}..HEAD --pretty=format:"- %s (%h)" >> $CHANGELOG_FILE
185+
else
186+
# No existing tags, get all commits
187+
git log --pretty=format:"- %s (%h)" >> $CHANGELOG_FILE
188+
fi
177189
178190
echo "" >> $CHANGELOG_FILE
179191
echo "" >> $CHANGELOG_FILE
180-
echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${LAST_TAG}...${NEW_VERSION}" >> $CHANGELOG_FILE
192+
193+
# Generate appropriate changelog link
194+
if git describe --tags --abbrev=0 >/dev/null 2>&1; then
195+
echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${LAST_TAG}...${NEW_VERSION}" >> $CHANGELOG_FILE
196+
else
197+
echo "**Full Changelog**: https://github.com/${{ github.repository }}/commits/${NEW_VERSION}" >> $CHANGELOG_FILE
198+
fi
181199
182200
# Read changelog content for the release
183201
CHANGELOG_CONTENT=$(cat $CHANGELOG_FILE)

‎SECURITY.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,117 @@
22

33
## Supported Versions
44

5+
The following versions of SQLite MCP Server are currently supported with security updates:
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| 0.1.x | :white_check_mark: |
10+
| < 0.1 | :x: |
11+
12+
**Note**: As this is an early-stage project, we currently only support the latest minor version. Once we reach version 1.0, we will maintain security support for multiple versions.
13+
14+
## Reporting a Vulnerability
15+
16+
We take security vulnerabilities seriously. If you discover a security issue in SQLite MCP Server, please report it responsibly.
17+
18+
### How to Report
19+
20+
**For security vulnerabilities, please do NOT create a public GitHub issue.**
21+
22+
Instead, please report security vulnerabilities through one of the following methods:
23+
24+
1. **GitHub Security Advisories** (Recommended)
25+
- Go to the [Security tab](https://github.com/nipunap/sqlite-mcp-server/security) of this repository
26+
- Click "Report a vulnerability"
27+
- Fill out the security advisory form
28+
29+
2. **Email** (Alternative)
30+
- Send an email with details to the repository maintainer
31+
- Include "SECURITY" in the subject line
32+
- Provide as much detail as possible about the vulnerability
33+
34+
### What to Include
35+
36+
When reporting a vulnerability, please include:
37+
38+
- **Description**: A clear description of the vulnerability
39+
- **Steps to Reproduce**: Detailed steps to reproduce the issue
40+
- **Impact**: What could an attacker accomplish with this vulnerability?
41+
- **Affected Versions**: Which versions of the software are affected
42+
- **Suggested Fix**: If you have ideas for how to fix the issue (optional)
43+
- **Proof of Concept**: Code or screenshots demonstrating the vulnerability (if applicable)
44+
45+
### Response Timeline
46+
47+
We are committed to responding to security reports promptly:
48+
49+
- **Initial Response**: Within 48 hours of receiving the report
50+
- **Status Updates**: Weekly updates on investigation progress
51+
- **Resolution Timeline**: We aim to resolve critical vulnerabilities within 7 days, and other vulnerabilities within 30 days
52+
53+
### What to Expect
54+
55+
**If the vulnerability is accepted:**
56+
- We will work with you to understand and reproduce the issue
57+
- We will develop and test a fix
58+
- We will coordinate the disclosure timeline with you
59+
- We will credit you in the security advisory (unless you prefer to remain anonymous)
60+
- We will release a security update and publish a security advisory
61+
62+
**If the vulnerability is declined:**
63+
- We will provide a clear explanation of why we don't consider it a security issue
64+
- We may suggest alternative ways to address your concerns
65+
- You are welcome to discuss our decision if you disagree
66+
67+
## Security Best Practices
68+
69+
When using SQLite MCP Server, please follow these security best practices:
70+
71+
### Database Security
72+
- **File Permissions**: Ensure database files have appropriate file system permissions
73+
- **Access Control**: Limit access to database files to authorized users only
74+
- **Backup Security**: Secure your database backups appropriately
75+
76+
### Network Security
77+
- **Local Use**: SQLite MCP Server is designed for local use; avoid exposing it over networks
78+
- **Input Validation**: Always validate and sanitize inputs when building applications on top of the server
79+
80+
### Configuration Security
81+
- **Minimal Permissions**: Run the server with minimal required permissions
82+
- **Regular Updates**: Keep the server updated to the latest supported version
83+
- **Monitoring**: Monitor server logs for suspicious activity
84+
85+
## Scope
86+
87+
This security policy covers:
88+
- The SQLite MCP Server core application
89+
- Official Docker images (if any)
90+
- Official documentation and examples
91+
92+
This policy does not cover:
93+
- Third-party integrations or plugins
94+
- User-created configurations or customizations
95+
- Issues in dependencies (report these to the respective projects)
96+
97+
## Security Features
98+
99+
SQLite MCP Server includes the following security features:
100+
101+
- **Input Validation**: SQL injection protection through prepared statements
102+
- **Error Handling**: Secure error messages that don't leak sensitive information
103+
- **Resource Limits**: Protection against resource exhaustion attacks
104+
- **Safe Defaults**: Secure default configuration settings
105+
106+
## Acknowledgments
107+
108+
We appreciate the security research community and will acknowledge researchers who report valid security vulnerabilities (unless they prefer to remain anonymous).
109+
110+
---
111+
112+
**Last Updated**: December 2024
113+
114+
For general questions about this security policy, please create a public GitHub issue with the "security" label.
115+
=======
5116
Use this section to tell people about which versions of your project are
6117
currently being supported with security updates.
7118

0 commit comments

Comments
 (0)