## Security Policy This document defines how MokoOnyx handles vulnerability intake, triage, remediation, and disclosure. The objective is to reduce risk, protect downstream users, and preserve operational continuity with a verifiable audit trail. ## Scope This policy applies to: * Repository source code, workflows, scripts, and build artifacts. * Release packaging (ZIP outputs) generated from the repository. * Configuration and metadata used for distribution (for example manifests and update metadata). Out of scope: * Vulnerabilities in upstream Joomla core, third party extensions, or external infrastructure not controlled by this repository. * Issues that require physical access to a host, compromised administrator credentials, or a compromised hosting provider, unless the repository materially increases impact. ## Supported Versions Security fixes are prioritized for: * The latest released version. * The current development line when it is actively used for release engineering. Backports may be provided based on impact, deployment footprint, and engineering capacity. ## Reporting a Vulnerability Use one of the following channels: * GitHub Security Advisories (preferred): use the repository security tab to submit a private report. * Email: send details to `hello@mokoconsulting.tech` with subject `SECURITY: MokoOnyx vulnerability report`. Do not file a public GitHub issue for suspected security vulnerabilities. ### What to include Provide enough detail to reproduce and triage: * A clear description of the vulnerability and expected impact. * A minimal proof of concept or reproduction steps. * Affected versions, configuration assumptions, and environment details. * Any proposed mitigation or patch. * Your preferred contact details for follow up. ## Triage and Response Targets The project operates with response targets aligned to practical delivery realities: * **Acknowledgement:** within 3 business days. * **Initial triage:** within 10 business days. * **Fix plan:** communicated once severity is confirmed. These targets are not guarantees. Complex issues, supply chain considerations, and coordination with upstream vendors may extend timelines. ## Severity Assessment Issues are triaged based on business impact and technical exploitability, including: * Remote exploitability and required privileges. * Data confidentiality, integrity, and availability impact. * Likelihood of exploitation in typical Joomla deployments. * Exposure surface (public endpoints, administrator area, installation flows, and update mechanisms). When appropriate, industry standard scoring such as CVSS may be used for internal prioritization. ## Coordinated Disclosure The project follows coordinated vulnerability disclosure: * Reports are treated as confidential until remediation is available. * A public advisory may be published once a fix is released. * A reasonable embargo period is expected to enable patch distribution. If you believe disclosure is time sensitive due to active exploitation, include that assessment and any supporting indicators. ## Security Updates and Advisories Security updates are distributed through: * GitHub releases for the repository. * GitHub Security Advisories when applicable. Advisories may include: * Affected versions and fixed versions. * Mitigations and workarounds when a fix is not immediately available. * Upgrade guidance. ## Dependencies and Supply Chain Controls The project aims to manage supply chain risk through: * Pinning and review of workflow dependencies where feasible. * Minimizing privileged GitHub token permissions. * Validating build inputs prior to packaging releases. If you identify a supply chain issue (for example compromised action, dependency confusion, or malicious upstream artifact), report it as a vulnerability. ## Secure Development and CI Expectations Security posture is reinforced through operational controls: * CI validation for packaging inputs and manifest integrity. * Consistent path normalization and whitespace hygiene checks where required for release correctness. * Least privilege for GitHub Actions permissions. ### Template Security Features **Custom Head Content Injection** The template provides Custom Head Code fields (`custom_head_start` and `custom_head_end`) that allow administrators to inject custom HTML, CSS, and JavaScript code. This is an intentional feature for: * Adding analytics scripts (Google Analytics, Google Tag Manager) * Custom meta tags * Third-party integrations * Custom styling **Security Considerations:** * These fields use `filter="raw"` to allow HTML/JS injection * **Access is restricted to Joomla administrators only** via template configuration * This is not an XSS vulnerability as it requires administrator privileges * Administrators should only add trusted code from verified sources * Regular security audits should review custom head content This policy does not guarantee that all vulnerabilities will be prevented. It defines how risk is managed when issues are discovered. ## Safe Harbor The project supports good faith security research. When you: * Avoid privacy violations, data destruction, and service disruption. * Limit testing to systems you own or have explicit permission to test. * Provide a reasonable window for coordinated disclosure. Then the project will treat your report as a constructive security contribution. Jurisdiction note: this repository is managed from Tennessee, USA. This note is informational only and does not constitute legal advice. ## Public Communications Only maintainers will publish security advisories or public statements for confirmed vulnerabilities. Public communication will focus on actionable remediation and operational risk reduction. ## Acknowledgements If you want credit, include the name or handle to list in an advisory. If you prefer anonymity, state that explicitly. --- ## Metadata * **Document:** SECURITY.md * **Repository:** [https://git.mokoconsulting.tech/MokoConsulting/MokoOnyx](https://git.mokoconsulting.tech/MokoConsulting/MokoOnyx) * **Path:** /SECURITY.md * **Owner:** Moko Consulting * **Version:** 03.06.00 * **Status:** Active * **Effective Date:** 2025-12-18 * **Last Reviewed:** 2025-12-18 ## Revision History | Date | Change Summary | Author | | ---------- | ------------------------------------------------------------------------------------------------ | --------------- | | 2026-01-30 | Added Template Security Features section documenting custom head content injection controls. | Copilot Agent | | 2025-12-18 | Initial publication of security policy, intake channels, triage targets, and disclosure process. | Moko Consulting |