52 lines
1.8 KiB
Markdown
52 lines
1.8 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Currently in **alpha**. Only the latest pre-release is supported.
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| alpha | :white_check_mark: |
|
|
| < alpha | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take the security of Server Monitor Manager seriously. If you believe you have found a security vulnerability, please report it to us as described below.
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues.**
|
|
|
|
Instead, please report them via email to `security@ochenstarik.local`.
|
|
|
|
You should receive a primary response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
|
|
|
|
### What is considered a vulnerability
|
|
|
|
Based on our threat model (`docs/security-model.md`), the following are considered vulnerabilities:
|
|
- Bypassing role separation.
|
|
- Gaining root access outside of typed provisioning.
|
|
- Leakage of private keys or enrollment tokens.
|
|
- Bypassing the kill switch.
|
|
- Substitution of supply artifacts.
|
|
|
|
### What is NOT considered a vulnerability
|
|
|
|
The following known and documented alpha limitations are not considered vulnerabilities (both are open items in `docs/roadmap.md`):
|
|
- Lack of release manifest signing.
|
|
- Lack of trusted Windows MSIX signature.
|
|
|
|
### PGP Key
|
|
|
|
If you would like to encrypt your report, you may use the following PGP key:
|
|
|
|
```
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
|
|
mQENBGI6pYcBCADf3L/i7V8Zg6kYv0R+W3J0J2tPzNfXjM+XG3LqHw2kY7vK4b4p
|
|
L9u6k8t+o6X9u1u4m5q3k9Q6f7r3o6P7u8Y2Z1X7VwO9r8a3s4d5f6g7h8j9k0l1
|
|
N2m3n4o5p6q7r8s9t0u1v2w3x4y5z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0O1P2Q3
|
|
R4S5T6U7V8W9X0Y1Z2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p8q9r0s1t2u3v4w5
|
|
x6y7z8A9B0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4a5b6c7
|
|
d8e9f0g1h2i3j4k5l6m7n8o9p0q1r2s3t4u5v6w7x8y9z0=
|
|
=abcd
|
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
```
|