Update: Enhanced project docs

Signed-off-by: Son Nguyen <[email protected]>

.github/SECURITY.md

@@ -0,0 +1,70 @@
+# Weathermate - Security Policies
+
+## Introduction
+Weathermate is a dynamic web application designed to provide users with an engaging platform to explore and learn about various movies, directors, actors, and more. Ensuring the security of our users and the application is of paramount importance. This document outlines the security measures, policies, and best practices implemented in Weathermate.
+
+Current MovieVerse Version: `1.1.0`
+
+## Security Measures
+
+### 1. Data Protection and Privacy
+- **User Data**: All user data is handled in accordance with privacy laws and regulations. Personal information is encrypted and stored securely.
+- **Cookies and Sessions**: Sessions are managed securely. Cookies, if used, are encrypted and do not store sensitive information.
+
+### 2. Secure Communication
+- **HTTPS**: Weathermate enforces HTTPS to ensure secure communication over the internet, encrypting data in transit.
+
+### 3. Input Validation and Sanitization
+- **Form Inputs**: All inputs from forms are validated and sanitized to prevent SQL injection, XSS attacks, and other forms of data tampering.
+- **API Requests**: Inputs via API requests are also validated and sanitized.
+
+### 4. Authentication and Authorization
+- **OAuth2**: For user authentication, Weathermate implements OAuth2 protocol, ensuring secure authorization.
+- **Role-Based Access Control**: Different levels of access are enforced depending on the user's role to prevent unauthorized access to sensitive data.
+
+### 5. Cross-Site Scripting (XSS) Protection
+- **Content Security Policy**: The application implements Content Security Policy (CSP) headers to prevent XSS attacks.
+- **Output Encoding**: Data output to the browser is encoded to prevent the execution of malicious scripts.
+
+### 6. Cross-Site Request Forgery (CSRF) Protection
+- **CSRF Tokens**: Forms include unique CSRF tokens to ensure that the requests are legitimate and originating from the application itself.
+
+### 7. API Security
+- **Rate Limiting**: To prevent abuse and potential DDoS attacks, API rate limiting is in place.
+- **API Key Protection**: API keys, if used, are kept confidential and not exposed to the client-side.
+
+### 8. Secure File Uploads
+- **File Type Restrictions**: Only specific file types are allowed for upload to prevent the execution of malicious scripts.
+- **File Scanning**: Uploaded files are scanned for malware.
+
+### 9. Error Handling and Logging
+- **Error Handling**: Proper error handling is implemented to prevent leakage of sensitive information through error messages.
+- **Logging**: System activities are logged for monitoring and auditing purposes. Logs do not contain sensitive user data.
+
+### 10. Dependency and Library Management
+- **Regular Updates**: Dependencies and libraries are regularly updated to their latest secure versions to mitigate known vulnerabilities.
+- **Vulnerability Scanning**: Regular scans are conducted to identify and address potential vulnerabilities in third-party libraries.
+
+### 11. Infrastructure Security
+- **Server Security**: Servers are hardened, and access is restricted to authorized personnel only.
+- **Firewalls and Intrusion Detection Systems**: Firewalls and IDS are in place to detect and prevent unauthorized access.
+
+## Incident Response Plan
+Weathermate has an incident response plan to quickly address and mitigate any security incidents. This includes:
+- Immediate identification and isolation of the incident.
+- Analysis and investigation of the breach.
+- Prompt resolution and recovery measures.
+- Communication with affected users and stakeholders.
+- Post-incident analysis and implementation of preventive measures.
+
+## Reporting Security Issues
+We encourage responsible disclosure of any security vulnerabilities. Please report any security concerns or vulnerabilities to us at [[email protected]](mailto:[email protected]). We are committed to working with security researchers and the community to resolve issues efficiently and responsibly.
+
+## Continuous Improvement
+Security is an ongoing process. Weathermate App is committed to continuously improving the security posture of the application by staying up-to-date with the latest security trends, threats, and mitigation techniques.
+
+## Contact Information
+
+For any queries or concerns regarding security, please contact us at [[email protected]](mailto:[email protected]).
+
+---