4cc873883c
- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
actions/checkout@v6 -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
76 lines
3 KiB
Markdown
76 lines
3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Server Monitor Manager is currently in alpha. Only the latest pre-release is
|
|
supported with security fixes:
|
|
|
|
| Version | Supported |
|
|
|---|---|
|
|
| latest alpha (v0.1.0-alpha.6) | ✅ |
|
|
| earlier alphas | ❌ |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Do not open a public GitHub issue for security vulnerabilities.**
|
|
|
|
Report vulnerabilities privately via GitHub's built-in mechanism:
|
|
[Security → Report a vulnerability](https://github.com/ochenstarik-ui/server-monitor-manager/security/advisories/new)
|
|
|
|
This opens a private advisory draft visible only to repository maintainers.
|
|
|
|
### What to include
|
|
|
|
- A description of the vulnerability and its potential impact.
|
|
- Steps to reproduce or a proof-of-concept (even a minimal one).
|
|
- The version or commit you tested against.
|
|
- Your GitHub handle or email if you want to be credited.
|
|
|
|
### Response timeline
|
|
|
|
| Milestone | Target |
|
|
|---|---|
|
|
| Initial acknowledgement | Within **72 hours** of receipt |
|
|
| Triage and severity assessment | Within **7 days** |
|
|
| Patch or mitigation plan | Communicated within **14 days** |
|
|
| Public disclosure | Coordinated with the reporter |
|
|
|
|
## Threat Model and Scope
|
|
|
|
Server Monitor Manager installs binaries that run as **root** on servers and
|
|
manages firewall rules. The following are considered **in-scope
|
|
vulnerabilities**:
|
|
|
|
- **Role separation bypass** — an Agent being able to perform Control
|
|
operations or vice versa without explicit provisioning.
|
|
- **Unauthorized root execution** — obtaining root-level code execution
|
|
outside of the typed provisioning flow (`install-control`,
|
|
`install-agent`).
|
|
- **Private key or enrollment token leakage** — exposure of mTLS private
|
|
keys, CA keys, or enrollment tokens to unprivileged processes or logs.
|
|
- **Kill switch bypass** — circumventing the emergency kill switch
|
|
(`ochenstarik-smm-emergency`) or the disabled-link enforcement.
|
|
- **Supply chain / artifact substitution** — an attacker substituting
|
|
release artifacts or bootstrap scripts to deliver malicious binaries.
|
|
|
|
## Known Limitations (Not Vulnerabilities)
|
|
|
|
The following are **documented alpha limitations** and will not be treated as
|
|
security vulnerabilities until addressed in the roadmap:
|
|
|
|
- **Release manifest is not cryptographically signed.** The bootstrap manifest
|
|
(`server-monitor-manager-bootstrap-manifest.json`) includes a SHA-256
|
|
checksum but the manifest itself carries no signature. Tracked in
|
|
[`docs/roadmap.md`](docs/roadmap.md).
|
|
- **Windows MSIX is not trusted-signed.** The Windows installer is signed with
|
|
a test or self-signed certificate in CI. Trust requires a commercial code
|
|
signing certificate. Tracked in [`docs/roadmap.md`](docs/roadmap.md).
|
|
|
|
Both items are openly acknowledged limitations of the alpha stage. Reports
|
|
about these specific issues will be noted but not assigned a CVE or priority
|
|
fix until the roadmap items are scheduled.
|
|
|
|
## Security Model Reference
|
|
|
|
For a complete description of the trust boundaries, role separation, and
|
|
threat model see [`docs/security-model.md`](docs/security-model.md).
|