nuntius/SECURITY.md

Security policy

Supported versions

Security fixes go to the newest release and to the development branch. Older releases do not receive them.

Version	Supported
1.0.x	yes
older releases	no

Reporting a vulnerability

Do not open a public issue for a security problem. A public report tells everyone about the flaw before there is a fix. Report it privately to opensource@petrbalvin.org.

Include:

• the version or commit you tested, and the platform
• what the problem is, and what an attacker gains from it
• the smallest reproducer you have, ideally a test or a single command
• a suggested fix, if you have one

What to expect

• A human reads the report, and you get an acknowledgement.
• You are kept informed while the fix is being made, and told when it ships.
• The fix is released before the details are published, and the timing is agreed with you.
• The reporter is credited in the release notes unless they ask to remain anonymous.

Out of scope

• Findings that require the attacker to already run code as the user, or to have local access.
• Missing hardening with no demonstrated impact.
• Flaws in a third-party dependency: report them to that project, and to this one only when this project's use of it makes them reachable.
• Bypassing the per-IP rate limit from a rotating pool of addresses. nuntius has no CAPTCHA, no proof-of-work and no global rate limit; put a reverse proxy with those capabilities in front of it.
• Abuse from a compromised frontend that posts valid, allowlisted traffic at the configured rate. The token bucket bounds the volume; nothing else can distinguish it from real users.
• A compromised server. nuntius reads the SMTP password from the process environment, so anyone with root or ps access can read it from /proc/<pid>/environ.
• Downgrade of the SMTP transport on a STARTTLS port. Port 587 upgrades opportunistically by design; set smtp.require_tls = true to make the upgrade a hard requirement.
• Absence of DKIM signing and request signing. Outbound mail is signed by the SMTP provider, and message authenticity rests on the origin allowlist and the honeypot.
• Content carried by a configured Telegram channel. The submission summary reaches Telegram's servers, exactly as mail reaches the SMTP provider's; forms that must not share content with Telegram simply do not configure the channel.