ochenstarik-ui 4cc873883c chore: repo hygiene — pin actions, dependabot, SBOM, docs

- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
  actions/checkout@v6  -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
  actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
  actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
  actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
  softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
  SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist

2026-08-07 11:40:34 +07:00

3 KiB

Raw Blame History

Security Policy

Supported Versions

Server Monitor Manager is currently in alpha. Only the latest pre-release is supported with security fixes:

Version	Supported
latest alpha (v0.1.0-alpha.6)	✅
earlier alphas	❌

Reporting a Vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via GitHub's built-in mechanism: Security → Report a vulnerability

This opens a private advisory draft visible only to repository maintainers.

What to include

A description of the vulnerability and its potential impact.
Steps to reproduce or a proof-of-concept (even a minimal one).
The version or commit you tested against.
Your GitHub handle or email if you want to be credited.

Response timeline

Milestone	Target
Initial acknowledgement	Within 72 hours of receipt
Triage and severity assessment	Within 7 days
Patch or mitigation plan	Communicated within 14 days
Public disclosure	Coordinated with the reporter

Threat Model and Scope

Server Monitor Manager installs binaries that run as root on servers and manages firewall rules. The following are considered in-scope vulnerabilities:

Role separation bypass — an Agent being able to perform Control operations or vice versa without explicit provisioning.
Unauthorized root execution — obtaining root-level code execution outside of the typed provisioning flow (install-control, install-agent).
Private key or enrollment token leakage — exposure of mTLS private keys, CA keys, or enrollment tokens to unprivileged processes or logs.
Kill switch bypass — circumventing the emergency kill switch (ochenstarik-smm-emergency) or the disabled-link enforcement.
Supply chain / artifact substitution — an attacker substituting release artifacts or bootstrap scripts to deliver malicious binaries.

Known Limitations (Not Vulnerabilities)

The following are documented alpha limitations and will not be treated as security vulnerabilities until addressed in the roadmap:

Release manifest is not cryptographically signed. The bootstrap manifest (server-monitor-manager-bootstrap-manifest.json) includes a SHA-256 checksum but the manifest itself carries no signature. Tracked in docs/roadmap.md.
Windows MSIX is not trusted-signed. The Windows installer is signed with a test or self-signed certificate in CI. Trust requires a commercial code signing certificate. Tracked in docs/roadmap.md.

Both items are openly acknowledged limitations of the alpha stage. Reports about these specific issues will be noted but not assigned a CVE or priority fix until the roadmap items are scheduled.

Security Model Reference

For a complete description of the trust boundaries, role separation, and threat model see docs/security-model.md.

3 KiB Raw Blame History