Update README.md

doc/security/README.md

@@ -2,44 +2,7 @@
 
 This folder contains comprehensive security documentation for the API Dash project.
 
-## 📚 Documents
+## Purpose
-
-### 1. [STRIDE Threat Model](STRIDE_THREAT_MODEL.md)
-A comprehensive threat analysis of the API Dash application using the STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) framework.
-
-**Contents:**
-- System architecture and data flow analysis
-- Detailed threat identification across all STRIDE categories
-- Risk assessment and prioritization
-- Recommended security controls and mitigations
-- Security testing recommendations
-
-**Key Highlights:**
-- 23 identified threats across all STRIDE categories
-- Risk-scored threat matrix for prioritization
-- Immediate, short-term, and long-term action plans
-- Focus on critical issues: credential storage, dependency management, data integrity
-
-### 2. [Incident Response Plan (IRP)](INCIDENT_RESPONSE_PLAN.md)
-A structured incident response plan aligned with 2025 industry standards and best practices for handling security incidents in the API Dash open source project.
-
-**Contents:**
-- Incident response team structure and roles
-- Incident classification and severity levels
-- Complete incident response lifecycle (Detection → Recovery)
-- Specific response procedures for different incident types
-- Communication plans and templates
-- Post-incident review processes
-- Training and awareness programs
-
-**Key Features:**
-- Aligned with NIST, SANS, and ISO incident management standards
-- Clear SLAs for response times based on severity
-- Coordinated disclosure procedures
-- Compliance with GDPR, CCPA, and other regulations
-- Ready-to-use templates and checklists
-
-## 🎯 Purpose
 
 These documents serve to:
 
@@ -49,129 +12,61 @@ These documents serve to:
 4. **Build Trust**: Demonstrate commitment to security for users and contributors
 5. **Enable Collaboration**: Provide framework for security community engagement
 
-## 🚀 Quick Start
+## Quick Start
-
-### For Maintainers
-1. Review the [STRIDE Threat Model](STRIDE_THREAT_MODEL.md) to understand security risks
-2. Familiarize yourself with the [Incident Response Plan](INCIDENT_RESPONSE_PLAN.md)
-3. Ensure you're listed in the incident response team contacts
-4. Complete security training as outlined in the IRP
-5. Set up security tools and monitoring as recommended
 
 ### For Security Researchers
-1. Review our [Security Policy](../../SECURITY.md) for vulnerability reporting
+
-2. Understand the threat landscape via the STRIDE model
+1. Review our [Security Policy](https://github.com/foss42/apidash/blob/main/SECURITY.md) for vulnerability reporting
-3. Follow coordinated disclosure guidelines in the IRP
+2. Follow coordinated disclosure guidelines in the IRP
-4. Report security issues through GitHub Security Advisories
+3. Report security issues through GitHub Security Advisories
 
 ### For Users
+
 1. Follow security best practices in user documentation
 2. Keep API Dash updated to the latest version
 3. Report security concerns through proper channels
 4. Review security advisories when published
 
-## 📋 Implementation Status
+## Contact
-
-### Immediate Priorities (From Threat Model)
-- [ ] Implement secure credential storage using OS keychains
-- [ ] Enable GitHub Dependabot for dependency scanning
-- [ ] Add data integrity verification for local storage
-- [ ] Implement secure export functionality with warnings
-
-### In Progress
-- [x] STRIDE threat model completed
-- [x] Incident response plan established
-- [ ] Security testing framework setup
-- [ ] Automated security scanning in CI/CD
-
-### Planned
-- [ ] Regular security audits
-- [ ] Penetration testing
-- [ ] Security awareness training
-- [ ] Tabletop exercises for incident response
-
-## 🔄 Maintenance
-
-### Review Schedule
-- **Threat Model**: Quarterly review, update after major features
-- **Incident Response Plan**: Annual review, update after incidents
-- **Both**: Update based on security incidents and lessons learned
-
-### Version History
-| Document | Version | Date | Status |
-|----------|---------|------|--------|
-| STRIDE Threat Model | 1.0 | December 2025 | Current |
-| Incident Response Plan | 1.0 | December 2025 | Current |
-
-**Next Review Date**: March 2026
-
-## 📞 Contact
 
 ### Security Issues
+
 - **Preferred**: [GitHub Security Advisories](https://github.com/foss42/apidash/security/advisories/new)
-- **Email**: security@apidash.dev
+- **Email**: ankit[at]apidash.dev
 - **Response Time**: See IRP for SLAs based on severity
 
 ### Questions About Security Docs
+
 - Create a discussion in [GitHub Discussions](https://github.com/foss42/apidash/discussions)
 - Tag with `security` label
-- Contact maintainers via Discord #security channel
+- Contact maintainers via Discord #gsoc-foss-apidash channel
 
-## 🤝 Contributing to Security
+## Contributing to Security
 
 We welcome contributions to improve API Dash security:
 
-1. **Report Vulnerabilities**: Follow responsible disclosure in [SECURITY.md](../../SECURITY.md)
+1. **Report Vulnerabilities**: Follow responsible disclosure in [SECURITY.md](https://github.com/foss42/apidash/blob/main/SECURITY.md)
 2. **Suggest Improvements**: Open discussions for security enhancements
 3. **Security Testing**: Help with testing and validation
 4. **Documentation**: Improve security documentation and guides
 5. **Code Review**: Participate in security-focused code reviews
 
 ### Security Contributions Guidelines
-- All security-related PRs require review from security team members
+
+- All security-related PRs require review from project maintainers
 - Security fixes should include tests demonstrating the fix
 - Update threat model if addressing identified threats
-- Follow secure coding guidelines in developer docs
+- Follow [secure coding guidelines](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/stable-en/02-checklist/05-checklist.html)
 
-## 📖 Related Documentation
+## External Resources
-
-- [Main Security Policy](../../SECURITY.md) - How to report security vulnerabilities
-- [Contributing Guidelines](../../CONTRIBUTING.md) - General contribution guidelines
-- [Developer Guide](../dev_guide/README.md) - Development setup and practices
-- [Code of Conduct](../../CODE_OF_CONDUCT.md) - Community standards
-
-## 📚 External Resources
-
-### Security Frameworks
-- [STRIDE Threat Modeling (Microsoft)](https://learn.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20))
-- [NIST Incident Response Guide (SP 800-61)](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
-- [OWASP Mobile Security](https://owasp.org/www-project-mobile-security-testing-guide/)
 
 ### Tools and Standards
+
 - [CVSS Calculator](https://www.first.org/cvss/calculator/3.1)
 - [CWE - Common Weakness Enumeration](https://cwe.mitre.org/)
-- [CVE - Common Vulnerabilities and Exposures](https://cve.mitre.org/)
+- [CVE - Common Vulnerabilities and Exposures](https://www.cve.org)
 
 ### Flutter/Dart Security
+
 - [Flutter Security Best Practices](https://docs.flutter.dev/security)
 - [Dart Security Advisories](https://github.com/dart-lang/sdk/security/advisories)
-
-## 🏆 Acknowledgments
-
-This security documentation was created based on:
-- Industry-standard threat modeling methodologies (STRIDE, DREAD, PASTA)
-- NIST Cybersecurity Framework and Incident Response guidelines
-- ISO/IEC 27001/27035 standards
-- OWASP best practices
-- Real-world incident response experiences from the open source community
-- Guidance from security researchers and practitioners
-
-Special thanks to the security community and all researchers who help keep API Dash secure through responsible disclosure.
-
----
-
-**Document Classification**: Public  
-**Last Updated**: December 2025  
-**Maintained By**: API Dash Security Team
-
-For the latest version of this documentation, visit: https://github.com/foss42/apidash/tree/main/doc/security