From b09609d71f18422e5ef174cf1d8af8702ba28b78 Mon Sep 17 00:00:00 2001 From: drkjc Date: Wed, 14 Oct 2026 15:49:39 -0400 Subject: [PATCH 1/2] docs: add security policy --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..22792fe --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy + +## Reporting Security Vulnerabilities + +Spreedly takes security seriously and appreciates your help in keeping our products and services secure. If you discover a security vulnerability in this repository, please report it to us using one of the following methods. **Do not** open a public GitHub issue, pull request, or discussion describing the vulnerability. + +### Option 1: Spreedly Help Center + +Submit a security vulnerability report through the [Spreedly Help Center](https://spreedly.com/support/) by submitting a request to Customer Support. This will open a support ticket for you, allowing you to securely communicate with our security team. + +### Option 2: Spreedly Security Team + +Email our security team directly at **security@spreedly.com** with details about the vulnerability you've discovered. + +## What to Include in Your Report + +When reporting a security vulnerability, please include: + +- A clear description of the vulnerability +- Steps to reproduce the issue +- Potential impact of the vulnerability +- Any suggested fixes or mitigations (if available) + +## Response Timeline + +We will acknowledge receipt of your report within 48 hours and provide an initial assessment within 5 business days. We'll keep you informed of our progress as we work to address the issue. + +## Disclosure Policy + +We ask that you: + +- Allow us a reasonable amount of time to address the vulnerability before public disclosure +- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services +- Not access or modify data that does not belong to you + +Thank you for helping keep Spreedly and our customers secure. From 9436b182e248deb0eab0d8cc52c22bc09d70261f Mon Sep 17 00:00:00 2001 From: drkjc Date: Wed, 14 Oct 2026 15:49:39 -0400 Subject: [PATCH 2/2] docs: list runtime dependencies and licenses in NOTICE --- NOTICE | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/NOTICE b/NOTICE index d76665b..611d03b 100644 --- a/NOTICE +++ b/NOTICE @@ -1,2 +1,18 @@ Spreedly Composer Java Server SDK Copyright 2025-2026 Spreedly, Inc. + +This SDK depends on the following libraries at runtime. Maven resolves them +alongside the SDK; they are not bundled in its JAR. Full license texts are in +THIRD-PARTY-LICENSES. + +- com.google.code.gson:gson (Apache-2.0) +- com.google.errorprone:error_prone_annotations (Apache-2.0) +- com.squareup.okhttp3:okhttp (Apache-2.0) +- com.squareup.okio:okio (Apache-2.0) +- com.squareup.okio:okio-jvm (Apache-2.0) +- org.apache.commons:commons-lang3 (Apache-2.0) +- org.jetbrains:annotations (Apache-2.0) +- org.jetbrains.kotlin:kotlin-stdlib (Apache-2.0) +- org.jetbrains.kotlin:kotlin-stdlib-common (Apache-2.0) +- org.jetbrains.kotlin:kotlin-stdlib-jdk7 (Apache-2.0) +- org.jetbrains.kotlin:kotlin-stdlib-jdk8 (Apache-2.0)