56 lines
2.4 KiB
Markdown
56 lines
2.4 KiB
Markdown
|
# Security policy
|
||
|
|
|
||
|
|
## Supported versions
|
||
|
|
|
||
|
|
Security fixes go to the newest release and to the `development` branch. Older releases
|
||
|
|
do not receive them.
|
||
|
|
|
||
|
|
| Version | Supported |
|
||
|
|
|---|---|
|
||
|
|
| 1.0.x | yes |
|
||
|
|
| older releases | no |
|
||
|
|
|
||
|
|
## Reporting a vulnerability
|
||
|
|
|
||
|
|
**Do not open a public issue for a security problem.** A public report tells everyone
|
||
|
|
about the flaw before there is a fix. Report it privately to
|
||
|
|
**opensource@petrbalvin.org**.
|
||
|
|
|
||
|
|
Include:
|
||
|
|
|
||
|
|
- the version or commit you tested, and the platform
|
||
|
|
- what the problem is, and what an attacker gains from it
|
||
|
|
- the smallest reproducer you have, ideally a test or a single command
|
||
|
|
- a suggested fix, if you have one
|
||
|
|
|
||
|
|
## What to expect
|
||
|
|
|
||
|
|
- A human reads the report, and you get an acknowledgement.
|
||
|
|
- You are kept informed while the fix is being made, and told when it ships.
|
||
|
|
- The fix is released before the details are published, and the timing is agreed with
|
||
|
|
you.
|
||
|
|
- The reporter is credited in the release notes unless they ask to remain anonymous.
|
||
|
|
|
||
|
|
## Out of scope
|
||
|
|
|
||
|
|
- Findings that require the attacker to already run code as the user, or to have local
|
||
|
|
access.
|
||
|
|
- Missing hardening with no demonstrated impact.
|
||
|
|
- Flaws in a third-party dependency: report them to that project, and to this one only
|
||
|
|
when this project's use of it makes them reachable.
|
||
|
|
- Bypassing the per-IP rate limit from a rotating pool of addresses. nuntius has no
|
||
|
|
CAPTCHA, no proof-of-work and no global rate limit; put a reverse proxy with those
|
||
|
|
capabilities in front of it.
|
||
|
|
- Abuse from a compromised frontend that posts valid, allowlisted traffic at the
|
||
|
|
configured rate. The token bucket bounds the volume; nothing else can distinguish it
|
||
|
|
from real users.
|
||
|
|
- A compromised server. nuntius reads the SMTP password from the process environment,
|
||
|
|
so anyone with root or `ps` access can read it from `/proc/<pid>/environ`.
|
||
|
|
- Downgrade of the SMTP transport on a STARTTLS port. Port 587 upgrades opportunistically
|
||
|
|
by design; set `smtp.require_tls = true` to make the upgrade a hard requirement.
|
||
|
|
- Absence of DKIM signing and request signing. Outbound mail is signed by the SMTP
|
||
|
|
provider, and message authenticity rests on the origin allowlist and the honeypot.
|
||
|
|
- Content carried by a configured Telegram channel. The submission summary reaches
|
||
|
|
Telegram's servers, exactly as mail reaches the SMTP provider's; forms that must
|
||
|
|
not share content with Telegram simply do not configure the channel.
|