If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public issue
- Email security@signalwire.com with details
- Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Any suggested fixes
- Acknowledgment: Within 48 hours
- Initial Assessment: Within 7 days
- Resolution Target: Based on severity
Security updates are provided for the latest major version of each SDK.
| SDK | Supported Versions |
|---|---|
| @signalwire/realtime-api | Latest major |
| @signalwire/js | Latest major |
| signalwire (Python) | Latest major |
| signalwire (Ruby) | Latest major |
| signalwire (PHP) | Latest major |
When using SignalWire SDKs:
- Never commit credentials - Use environment variables for API tokens
- Rotate tokens regularly - Especially if you suspect compromise
- Use HTTPS - All SignalWire APIs require TLS
- Validate inputs - Sanitize user-provided data before passing to APIs
For security concerns: security@signalwire.com