Security Policy

Last Updated: July 6, 2026

Supported Versions

We release patches for security vulnerabilities. Currently supported versions:

Version	Supported
2026.x	✅ Yes
< 2026	❌ No

Reporting a Vulnerability

We take security seriously at Pantheon Security. If you discover a security vulnerability in MEDUSA, please report it to us privately so we can address it before public disclosure.

How to Report

Email: security@pantheonsecurity.io

What to Include

Please include the following information in your report:

• Description of the vulnerability - What is the issue?
• Steps to reproduce - How can we recreate the issue?
• Potential impact - What could an attacker do with this vulnerability?
• Affected versions - Which versions of MEDUSA are affected?
• Suggested fixes (optional) - Do you have ideas for how to fix it?
• Your name/handle (optional) - For acknowledgment in security advisories

Response Timeline

We aim to respond according to the following timeline:

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-7 days
  • High: 7-30 days
  • Medium: 30-90 days
  • Low: Best effort

Disclosure Policy

• We request that you give us reasonable time to fix the issue before public disclosure
• We will acknowledge your contribution in our security advisories (unless you prefer to remain anonymous)
• We may provide a CVE if the issue warrants one
• We will coordinate with you on the disclosure timeline

Security Updates

To receive security updates:

• Watch the MEDUSA repository on GitHub (Releases only)
• Follow @Sec_pantheon on Twitter
• Check the Security Advisories page

Supported Features

MEDUSA scans code for security issues but does not:

• Execute code from scanned projects
• Send data to external servers (all scanning is local)
• Require network access
• Store scan results remotely

Known Limitations

Please be aware of these limitations when using MEDUSA:

• Static analysis limits: Not all vulnerability classes can be detected statically; false positives and false negatives may occur
• Accuracy: We cannot guarantee 100% accuracy - review findings before acting on them

Security Best Practices

When using MEDUSA:

1. Keep MEDUSA updated to the latest version for security patches
2. Review scan results - don't blindly trust all findings
3. Pin the MEDUSA version in production CI/CD pipelines for reproducible results
4. Report false positives to help us improve detection accuracy
5. Combine with other tools - MEDUSA should be part of a defense-in-depth strategy
6. Verify tool integrity - download from official sources (PyPI, GitHub)

Bug Bounty

We currently do not offer a bug bounty program but deeply appreciate responsible disclosure. Security researchers who help us improve MEDUSA will be acknowledged in:

• Security advisories
• Release notes
• Our website (with your permission)

Third-Party Dependencies

MEDUSA is self-contained — scanning requires no external security tools. Issues in MEDUSA's own Python dependencies are monitored and updated promptly.

Open Source Transparency

MEDUSA is open source (AGPL-3.0 license). You can review the complete source code at github.com/Pantheon-Security/medusa to verify our security claims and practices.

Contact

For security-related inquiries:

• Security vulnerabilities: security@pantheonsecurity.io
• General questions: contact@pantheonsecurity.io
• GitHub Issues: github.com/Pantheon-Security/medusa/issues (non-security bugs only)