Use this section to tell people about which versions of your project are currently being supported with security updates.

We take security vulnerabilities seriously. If you discover a security vulnerability in the Ongoing Warehouse API PHP Client, please follow these steps:

Security vulnerabilities should be reported privately to avoid potential exploitation.

Send an email to phpdevsec@proton.me with the following information:

• Subject: [SECURITY] Ongoing API PHP Client Vulnerability Report
• Description: Detailed description of the vulnerability
• Steps to reproduce: Clear steps to reproduce the issue
• Impact: Potential impact of the vulnerability
• Suggested fix: If you have a suggested fix (optional)

Please include as much detail as possible:

• Version affected: Which version(s) of the library are affected
• Environment: PHP version, operating system, etc.
• Code example: Minimal code example that demonstrates the vulnerability
• Proof of concept: If possible, include a proof of concept
• Timeline: When you discovered the vulnerability

• Initial response: Within 48 hours
• Status update: Within 1 week
• Fix timeline: Depends on severity and complexity

• We will acknowledge receipt of your report within 48 hours
• We will provide regular updates on the status of the fix
• Once a fix is ready, we will:
  • Release a security patch
  • Update the CHANGELOG.md with security information
  • Credit you in the security advisory (unless you prefer to remain anonymous)

When using this library, please follow these security best practices:

Regularly update the library and its dependencies:

composer update ongoingwarehouse/ongoing-api-php

Always use HTTPS for API communications:

$config->setHost('https://api.ongoingsystems.se/your-warehouse');

Never hardcode credentials in your source code:

// Good: Use environment variables
$config->setUsername($_ENV['ONGOING_API_USERNAME']);
$config->setPassword($_ENV['ONGOING_API_PASSWORD']);

// Bad: Hardcoded credentials
$config->setUsername('myuser');
$config->setPassword('mypassword');

Always validate and sanitize data before sending to the API:

// Validate article numbers
if (!preg_match('/^[A-Z0-9-]+$/', $articleNumber)) {
    throw new InvalidArgumentException('Invalid article number format');
}

Don't expose sensitive information in error messages:

try {
    $articles = $articlesApi->articlesGetAll($goodsOwnerId);
} catch (ApiException $e) {
    // Log the full error for debugging
    error_log("API Error: " . $e->getMessage());
    
    // Show user-friendly message
    echo "An error occurred while fetching articles.";
}

Ensure your API credentials have the minimum required permissions:

• Use dedicated API users, not admin accounts
• Regularly rotate API credentials
• Monitor API usage for suspicious activity

This library includes several security features:

All API parameters are validated before being sent to the server.

The library enforces HTTPS connections by default.

The library uses secure defaults for all configurations.

Comprehensive error handling prevents information leakage.

Security updates will be released as patch versions (e.g., 1.0.1, 1.0.2) and will be clearly marked in the CHANGELOG.md file.

For security-related questions or concerns:

• Email: phpdevsec@proton.me
• PGP Key: Available upon request
• Response time: Within 48 hours

We thank all security researchers and users who responsibly report vulnerabilities to help keep our library secure.