The FRC Team 8092 "Greatest of All Times" takes security seriously. If you discover a security vulnerability in our website, please report it responsibly.

Please do NOT create a public GitHub issue for security vulnerabilities.

Instead, please email us at: iletisim@8092.tr with the subject line: "Security Vulnerability Report"

When reporting a security vulnerability, please include:

1. Description: A clear description of the vulnerability
2. Steps to Reproduce: Detailed steps to reproduce the issue
3. Impact: Potential impact of the vulnerability
4. Screenshots/Evidence: If applicable, include screenshots or other evidence
5. Your Contact Information: How we can reach you for follow-up

• Acknowledgment: We will acknowledge receipt within 48 hours
• Initial Assessment: We will provide an initial assessment within 5 business days
• Resolution: We will work to resolve critical issues within 30 days

We believe in recognizing security researchers who help us improve our security:

• We will acknowledge your contribution (with your permission)
• For significant findings, we may recognize you on our website
• All reports will be treated with respect and gratitude

• HTTPS: All traffic is encrypted with TLS 1.3
• Content Security Policy: Strict CSP to prevent XSS attacks
• Input Validation: All user inputs are validated and sanitized
• Dependencies: Regular updates and automated security audits
• Access Control: Limited repository access with role-based permissions
• Infrastructure: Vercel enterprise-grade security with DDoS protection
• Monitoring: Automated security monitoring and alerting
• Backups: Automated backups and disaster recovery

• No Personal Data Collection: We do not collect or store personal data beyond contact forms
• Contact Forms: Form submissions are handled securely via FormSpree
• Analytics: If implemented, only privacy-respecting analytics are used

• Hosting: Vercel enterprise platform with SOC 2 compliance
• CDN: Global content delivery with DDoS protection
• Monitoring: 24/7 automated monitoring and anomaly detection
• Edge Security: Web Application Firewall (WAF) and bot protection
• Compliance: GDPR and CCPA compliant infrastructure
• Deployment: Immutable deployments with atomic rollbacks
• Secrets Management: Secure environment variable handling

We only provide security updates for the latest version of the website.

• Automated Updates: Dependabot for security patches
• Regular Audits: Monthly security reviews of all dependencies
• Vulnerability Scanning: Automated scanning with GitHub Advanced Security
• Supply Chain Security: Signed packages and integrity verification
• Minimization: Regular dependency cleanup and removal of unused packages

• No Sensitive Data: No API keys or secrets in client-side code
• Secure Loading: All external resources loaded over HTTPS with integrity checks
• Content Security Policy: Strict CSP prevents unauthorized script execution
• Subresource Integrity: SRI hashes for all third-party scripts
• XSS Protection: Built-in browser protections and sanitization
• Clickjacking Protection: X-Frame-Options and frame-ancestors CSP

• CSRF Protection: Anti-CSRF tokens for all form submissions
• Rate Limiting: Tiered rate limiting to prevent abuse
• Input Validation: Server-side validation and sanitization
• Bot Detection: Automated bot filtering and CAPTCHA when needed
• Email Security: Secure email delivery with SPF/DKIM/DMARC
• Data Retention: Minimal data retention with automatic cleanup

We follow responsible disclosure practices:

1. Private Reporting: Vulnerabilities should be reported privately first
2. Coordination: We will work with you on disclosure timing
3. Public Disclosure: After fixing, we may publish details to help others
4. Credit: We will credit researchers (with permission)

The following are considered out of scope for security reports:

• Issues in third-party services (FormSpree, Vercel, etc.)
• Social engineering attacks
• Physical security issues
• Denial of service attacks
• Issues that require physical access to user devices

• Security Email: iletisim@8092.tr
• General Contact: iletisim@8092.tr
• Website: 8092.tr

Our approach to security embodies FIRST values:

• Discovery: We continuously learn about new security practices
• Innovation: We implement creative solutions for security challenges
• Impact: Security improvements protect our community
• Inclusion: Security measures are designed to be accessible to all users
• Teamwork: We collaborate with security researchers and the community
• Fun: We make security awareness engaging and educational

Thank you for helping keep the FRC Team 8092 website secure! 🛡️🤖