# Security Policy

## Reporting a Vulnerability

**Please do not report security vulnerabilities through the public issue queue.**

FlowDrop follows the Drupal Security Team process. To report a security
vulnerability:

1. Visit the Drupal Security Team contact form:
   https://www.drupal.org/security-team/report-issue

2. Alternatively, email the Drupal Security Team directly at:
   security@drupal.org

3. Include as much detail as possible:
   - A description of the vulnerability
   - Steps to reproduce
   - Potential impact
   - Affected versions (if known)

You will receive an acknowledgement within 48 hours. The security team will
work with the module maintainers to assess and address the issue before
public disclosure.

## Supported Versions

Security fixes are provided for the actively maintained branches:

| Branch | Supported |
|--------|-----------|
| 1.x    | Yes       |

Older branches receive security fixes only for a limited period after a new
major release. Check the project page for current support status:
https://www.drupal.org/project/flowdrop

## Security Advisories

Published security advisories are listed at:
https://www.drupal.org/security

Subscribe to the Drupal security advisories mailing list to receive
notifications: https://www.drupal.org/security/subscribe

## Security Considerations

### HttpRequest Node Processor

The `HttpRequest` node processor makes outbound HTTP requests to configured
URLs. To prevent SSRF (Server-Side Request Forgery), DNS rebinding protection
is applied: DNS resolution is performed before the request, and the resolved
IP address is pinned for the connection. Requests to private/loopback address
ranges are blocked by default.

### EntitySave Node Processor

The `EntitySave` processor can be configured to bypass normal access checks.
Restrict access to workflow configuration to trusted roles only.

### Workflow Permissions

Workflow execution can trigger arbitrary node processors. Grant the
"administer flowdrop workflows" and "execute flowdrop workflows" permissions
only to trusted roles.
