Skip to content

Security: telemetryflow/telemetryflow-php-sdk

Security

SECURITY.md

TelemetryFlow Logo

TelemetryFlow PHP SDK

Version License PHP Version OpenTelemetry Laravel

Coverage Core Generator Laravel%20Coverage Tests PHPStan

Enterprise-grade PHP SDK for TelemetryFlow — unified metrics, logs, and traces collection following OpenTelemetry standards. Ships as a monorepo with a framework-agnostic core, a first-class Laravel integration, and a Symfony Console code generator.


Security Policy

Supported Versions

Version Supported
1.0.x
< 1.0

Reporting a Vulnerability

If you discover a security vulnerability in the TelemetryFlow PHP SDK, please report it responsibly.

  • Do NOT open a public GitHub issue for security vulnerabilities.
  • Email: security@telemetryflow.id
  • Include a detailed description and, if possible, a proof of concept.

We acknowledge reports within 48 hours and aim to publish a fix within 30 days for critical issues.

API Key Management

  • API keys (tfk_/tfs_) must never be committed to source control.
  • Use environment variables or a secrets manager.
  • The .env file is gitignored by default.
  • Rotate keys immediately if you suspect a leak.

Transport Security

  • In production, always use TLS (TELEMETRYFLOW_INSECURE=false).
  • The SDK defaults to secure connections; only disable TLS for local development.

Built with ❤️ by Telemetri Data Indonesia collaboration with Kiro

There aren't any published security advisories