Security Policy

Supported Versions

Currently in alpha. Only the latest pre-release is supported.

Version	Supported
alpha	✅
< alpha	❌

Reporting a Vulnerability

We take the security of Server Monitor Manager seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via email to security@ochenstarik.local.

You should receive a primary response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

What is considered a vulnerability

Based on our threat model (docs/security-model.md), the following are considered vulnerabilities:

Bypassing role separation.
Gaining root access outside of typed provisioning.
Leakage of private keys or enrollment tokens.
Bypassing the kill switch.
Substitution of supply artifacts.

What is NOT considered a vulnerability

The following known and documented alpha limitations are not considered vulnerabilities (both are open items in docs/roadmap.md):

Lack of release manifest signing.
Lack of trusted Windows MSIX signature.

PGP Key

If you would like to encrypt your report, you may use the following PGP key:

1.8 KiB Raw Blame History