mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-11-11 12:57:40 +00:00
efitenandClaude Opus 5.5
6cafa3b596
## What Two additions, no code changes: 1. `SECURITY.md`: a private reporting channel (`security@fiten.eu`), the supported-version policy (latest release only) and the scope. The repo had no security policy, and GitHub private vulnerability reporting is not enabled (that needs repo admin). 2. `.oss-scanner/Dockerfile` and `.oss-scanner/threat_model.md`: the files needed to enrol CoreScope in Anthropic's [OSS Scanner](https://red.anthropic.com/oss-scanner/), which periodically audits a project and mails findings to the security contact. Enrolment itself is a separate PR in [anthropics/oss-scanner](https://github.com/anthropics/oss-scanner) that points at these paths; it is opened only after this one merges. ## Dockerfile - `golang:1.27-trixie`, native cgo build with the system compiler. It is not the release image: no zig, no static musl, because the scanner only needs a working host build. - Fetches every Go module (`scripts/allmod.sh mod download`) and the npm packages, runs `make build` with symbols kept, then `make test` and `sh test-all.sh` as a non-fatal baseline, and finally sets `GOPROXY=off`. ## Threat model Lists where untrusted input enters (radio packets via MQTT, the MQTT topics and JSON, unauthenticated `/api` and `/ws`, the user-management flows), the properties that matter (no crash on malformed input, no XSS from radio data, auth boundaries, the read/write separation from `AGENTS.md`), how to run the tests, a severity scale, and what to leave alone (MeshCore protocol design, data that is public by design). ## Testing - Built on an amd64 Linux host with `docker build -f .oss-scanner/Dockerfile .`: all build steps passed, `make test` reported 16 of 16 modules OK, `test-all.sh` ended with "All standalone frontend suites passed". - In the finished image with `--network none`: `go vet ./...` and `go test` in `cmd/server` pass, `GOPROXY=off` is set. - `tools/validate.py` from oss-scanner passes with the corresponding `project.yaml`. Not done: `tools/check corescope` (needs a fresh build plus a Claude Code install in the image; no Docker host with enough disk was free). `.dockerignore` excludes `*.db`, so the two tests that read `test-fixtures/e2e-fixture.db` (`cmd/decrypt`, `cmd/migrate`) skip inside the image; the threat model says so. ## Question The 7-day acknowledgement in `SECURITY.md` is a commitment from the current maintainer. If another maintainer wants to be on the reporting address too, say so and it can be added to the scanner's `auto_ccs`. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1.0 KiB
1.0 KiB
Security policy
Reporting a vulnerability
Please do not open a public issue, pull request or discussion for a security problem. Email security@fiten.eu instead, with:
- the affected version or commit,
- what an attacker needs (unauthenticated, logged-in user, admin, an MQTT observer, a radio node in range),
- steps or a test that reproduces it.
You will get an acknowledgement within 7 days. Once a fix is merged and released, the issue is described in the release notes. Tell us if you want to be credited.
Supported versions
Fixes go into master and ship in the next release. Only the latest release
receives security fixes.
Scope
In scope: the Go server (cmd/server/), the MQTT ingestor (cmd/ingestor/),
the shared packages in internal/, and the frontend in public/.
Out of scope: the MeshCore firmware and radio protocol themselves (report those
to MeshCore), and issues that need
an attacker who already controls the operator's config.json or host.