From 79e15aed7bbbabe2c100ab119b7f89f05c540cd2 Mon Sep 17 00:00:00 2001 From: drkjc Date: Wed, 14 Oct 2026 15:49:44 -0400 Subject: [PATCH 1/2] docs: add security policy --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..22792fe --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy + +## Reporting Security Vulnerabilities + +Spreedly takes security seriously and appreciates your help in keeping our products and services secure. If you discover a security vulnerability in this repository, please report it to us using one of the following methods. **Do not** open a public GitHub issue, pull request, or discussion describing the vulnerability. + +### Option 1: Spreedly Help Center + +Submit a security vulnerability report through the [Spreedly Help Center](https://spreedly.com/support/) by submitting a request to Customer Support. This will open a support ticket for you, allowing you to securely communicate with our security team. + +### Option 2: Spreedly Security Team + +Email our security team directly at **security@spreedly.com** with details about the vulnerability you've discovered. + +## What to Include in Your Report + +When reporting a security vulnerability, please include: + +- A clear description of the vulnerability +- Steps to reproduce the issue +- Potential impact of the vulnerability +- Any suggested fixes or mitigations (if available) + +## Response Timeline + +We will acknowledge receipt of your report within 48 hours and provide an initial assessment within 5 business days. We'll keep you informed of our progress as we work to address the issue. + +## Disclosure Policy + +We ask that you: + +- Allow us a reasonable amount of time to address the vulnerability before public disclosure +- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services +- Not access or modify data that does not belong to you + +Thank you for helping keep Spreedly and our customers secure. From 988e230cc6691a37b70f19ad84c8b83d71212042 Mon Sep 17 00:00:00 2001 From: drkjc Date: Wed, 14 Oct 2026 15:49:44 -0400 Subject: [PATCH 2/2] docs: list runtime dependencies and licenses in NOTICE --- NOTICE | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/NOTICE b/NOTICE index 568d319..65eb279 100644 --- a/NOTICE +++ b/NOTICE @@ -1,2 +1,12 @@ Spreedly Composer Python Server SDK Copyright 2025-2026 Spreedly, Inc. + +This SDK depends on the following packages at runtime. pip installs them +alongside the SDK; they are not bundled with it. Full license texts are in +THIRD-PARTY-LICENSES. + +- requests (Apache-2.0) +- urllib3 (MIT) +- idna (BSD-3-Clause) +- charset-normalizer (MIT) +- certifi (MPL-2.0)