We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:

Please report (suspected) security vulnerabilities to security@netskope.com. You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.

When we receive a security bug report, we will:

1. Confirm the problem and determine the affected versions.
2. Audit code to find any potential similar problems.
3. Prepare fixes for all still-supported versions.
4. Release new versions of all supported packages.
5. Announce the problem on our security mailing list.

If you have suggestions on how this process could be improved, please submit a pull request.

1. Never commit API keys to source control
2. Rotate API keys regularly
3. Use environment variables for sensitive data
4. Implement key expiration
5. Monitor key usage

Example:

// Bad
const API_KEY = "sk_live_123...";

// Good
const API_KEY = process.env.NETSKOPE_API_KEY;
if (!API_KEY) {
  throw new Error("NETSKOPE_API_KEY environment variable is required");
}

1. Validate all input parameters
2. Use TypeScript types and Zod schemas
3. Sanitize user input
4. Implement request rate limiting
5. Add request size limits

Example:

import { z } from "zod";

const PublisherSchema = z.object({
  name: z.string()
    .min(1)
    .max(64)
    .regex(/^[a-zA-Z0-9-_]+$/),
  description: z.string().optional(),
  enabled: z.boolean().default(true)
});

type Publisher = z.infer<typeof PublisherSchema>;

1. Don't expose internal errors
2. Log security events
3. Implement proper error responses
4. Use custom error types
5. Add error tracking

Example:

class SecurityError extends Error {
  constructor(
    message: string,
    public code: string,
    public statusCode: number = 403
  ) {
    super(message);
    this.name = "SecurityError";
  }
}

try {
  // Operation that might fail
} catch (error) {
  if (error instanceof SecurityError) {
    logger.error("Security violation", {
      code: error.code,
      message: error.message
    });
    // Handle security error
  }
  // Handle other errors
}

1. Use secure session management
2. Implement proper access controls
3. Add request signing
4. Use secure headers
5. Enable audit logging

Example:

async function validateRequest(req: Request) {
  const apiKey = req.headers["x-api-key"];
  if (!apiKey) {
    throw new SecurityError(
      "Missing API key",
      "MISSING_API_KEY"
    );
  }

  const signature = req.headers["x-signature"];
  if (!signature) {
    throw new SecurityError(
      "Missing request signature",
      "MISSING_SIGNATURE"
    );
  }

  if (!validateSignature(req.body, signature)) {
    throw new SecurityError(
      "Invalid request signature",
      "INVALID_SIGNATURE"
    );
  }
}

1. Use HTTPS for all requests
2. Implement proper data encryption
3. Add secure headers
4. Enable audit logging
5. Implement data retention policies

Example:

import { createHash } from "crypto";

function hashSensitiveData(data: string): string {
  return createHash("sha256")
    .update(data)
    .digest("hex");
}

const sensitiveData = "user-data";
const hashedData = hashSensitiveData(sensitiveData);

1. Use HTTPS
2. Enable CORS properly
3. Set secure headers
4. Implement rate limiting
5. Add IP filtering

Example:

import helmet from "helmet";
import rateLimit from "express-rate-limit";

app.use(helmet());
app.use(rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // limit each IP to 100 requests per windowMs
}));

1. Keep dependencies updated
2. Use dependency scanning
3. Implement lockfiles
4. Review security advisories
5. Use trusted packages

Example:

{
  "scripts": {
    "audit": "npm audit",
    "outdated": "npm outdated",
    "update": "npm update",
    "security-check": "npm run audit && npm run outdated"
  }
}

• Use TypeScript with strict mode
• Implement proper error handling
• Add input validation
• Use secure dependencies
• Enable linting rules

• Validate API keys
• Implement rate limiting
• Add request signing
• Use HTTPS
• Enable CORS properly

• Encrypt sensitive data
• Implement access controls
• Add audit logging
• Use secure headers
• Set up monitoring

• Add security tests
• Test error cases
• Validate input handling
• Check rate limiting
• Test authentication

Please contact us at security@netskope.com for any security-related questions or concerns.