akanealw
99819b70ff
Some checks failed
Build and Push Docker Images (Trusted) / build-and-push (., docker/caddy/Dockerfile, caddy) (push) Has been cancelled
Build and Push Docker Images (Trusted) / build-and-push (., docker/l4-port-manager/Dockerfile, l4-port-manager) (push) Has been cancelled
Build and Push Docker Images (Trusted) / build-and-push (., docker/web/Dockerfile, web) (push) Has been cancelled
Tests / test (push) Has been cancelled
2.4 KiB
Executable File
2.4 KiB
Executable File
Security Policy
Supported Versions
We release patches for security vulnerabilities for the following versions:
| Version | Supported |
|---|---|
| latest | ✅ |
| < 1.0 | ❌ |
Reporting a Vulnerability
If you discover a security vulnerability, please report it by:
- DO NOT open a public issue
- Email the maintainers or use GitHub's private vulnerability reporting
- Include detailed information about the vulnerability:
- Type of vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
We will respond within 48 hours and provide regular updates on the fix progress.
Security Measures
Build Pipeline Security
Our CI/CD pipeline implements multiple security layers:
- Fork PR Protection: Pull requests from forks require manual approval (via
safe-to-buildlabel) before builds run - SBOM Generation: Software Bill of Materials is generated for all builds
- Provenance Attestation: Build provenance is recorded for supply chain security
- Limited Permissions: Workflows use minimal required permissions
- No Push from PRs: Pull requests only build images locally, never push to registry
Container Security
- Verified amd64 image builds
- Regular base image updates
- Minimal attack surface
- Non-root user execution where possible
Dependency Management
- Automated dependency updates via Dependabot
- Security alerts enabled
- Regular security audits
Security Best Practices for Contributors
When contributing:
- Never commit secrets, tokens, or credentials
- Use environment variables for sensitive configuration
- Keep dependencies up to date
- Follow principle of least privilege
- Validate and sanitize all user inputs
- Use parameterized queries for database operations
Automated Security Checks
Our repository includes:
- Dependabot for dependency updates
- GitHub Security Advisories monitoring
Safe-to-Build Label
For maintainers reviewing fork PRs:
- Review the PR code thoroughly for malicious content
- Check for suspicious file modifications
- Verify no secrets or credentials are exposed
- Only add
safe-to-buildlabel if code is verified safe - Remove label immediately if concerns arise
Security Updates
Security updates are prioritized and released as soon as possible. Subscribe to repository releases to stay informed.