feat: contact form backend for linux and freebsd servers

Assisted-by: GLM 5.3 Flash
2026-09-29 00:32:56 +02:00
commit 3a38f00dc0
49 changed files with 10769 additions and 0 deletions
@@ -0,0 +1,55 @@
+# Security policy
+
+## Supported versions
+
+Security fixes go to the newest release and to the `development` branch. Older releases
+do not receive them.
+
+| Version | Supported |
+|---|---|
+| 1.0.x | yes |
+| older releases | no |
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** A public report tells everyone
+about the flaw before there is a fix. Report it privately to
+**opensource@petrbalvin.org**.
+
+Include:
+
+- the version or commit you tested, and the platform
+- what the problem is, and what an attacker gains from it
+- the smallest reproducer you have, ideally a test or a single command
+- a suggested fix, if you have one
+
+## What to expect
+
+- A human reads the report, and you get an acknowledgement.
+- You are kept informed while the fix is being made, and told when it ships.
+- The fix is released before the details are published, and the timing is agreed with
+  you.
+- The reporter is credited in the release notes unless they ask to remain anonymous.
+
+## Out of scope
+
+- Findings that require the attacker to already run code as the user, or to have local
+  access.
+- Missing hardening with no demonstrated impact.
+- Flaws in a third-party dependency: report them to that project, and to this one only
+  when this project's use of it makes them reachable.
+- Bypassing the per-IP rate limit from a rotating pool of addresses. nuntius has no
+  CAPTCHA, no proof-of-work and no global rate limit; put a reverse proxy with those
+  capabilities in front of it.
+- Abuse from a compromised frontend that posts valid, allowlisted traffic at the
+  configured rate. The token bucket bounds the volume; nothing else can distinguish it
+  from real users.
+- A compromised server. nuntius reads the SMTP password from the process environment,
+  so anyone with root or `ps` access can read it from `/proc/<pid>/environ`.
+- Downgrade of the SMTP transport on a STARTTLS port. Port 587 upgrades opportunistically
+  by design; set `smtp.require_tls = true` to make the upgrade a hard requirement.
+- Absence of DKIM signing and request signing. Outbound mail is signed by the SMTP
+  provider, and message authenticity rests on the origin allowlist and the honeypot.
+- Content carried by a configured Telegram channel. The submission summary reaches
+  Telegram's servers, exactly as mail reaches the SMTP provider's; forms that must
+  not share content with Telegram simply do not configure the channel.