agessaman
ad7df3438b
CONTRIBUTING covers dev setup, reproducing all six CI jobs locally, and the house rules a newcomer would otherwise trip over: append-only migrations, config changes needing config.ini.example updates, new docs pages needing an mkdocs nav entry, the ruff pin, and PRs targeting dev. SECURITY routes reports through GitHub private vulnerability reporting rather than an email address, with a 10-day acknowledgement and 30-day assessment window. Scope names what this codebase actually exposes, and explicitly puts the MeshCore protocol, RF-layer attacks, and running the viewer without a password out of scope. Issue forms collect the details every radio bug report needs — version, transport, hardware, install method — and the feature form asks up front whether a proposal spends mesh airtime. Blank issues stay enabled since Discussions is not turned on, so they are the only route for questions. Dependabot covers GitHub Actions weekly, where a stale or compromised action is a real supply-chain risk. pip and npm are grouped and monthly: runtime deps are >= ranges, so version updates are mostly floor bumps, and security fixes arrive through Dependabot alerts regardless.
2.8 KiB
Security Policy
Supported versions
| Version | Supported |
|---|---|
| 1.0.x | ✅ Security fixes |
| < 1.0 | ❌ Please upgrade |
Reporting a vulnerability
Please report security issues privately rather than opening a public issue.
Use GitHub's private vulnerability reporting: go to the Security tab of this repository and choose Report a vulnerability. The report is visible only to the maintainers — nothing is disclosed publicly until a fix is ready.
Please include:
- A description of the issue and the impact you believe it has
- The affected component and version (
git describe --tags) - Steps to reproduce
- Any relevant configuration, with keys and tokens redacted
What to expect: acknowledgement within 10 days and an assessment within 30 days, followed by coordinated disclosure once a fix is available. This is a volunteer-maintained project — there is no bug bounty, but reporters are credited in the changelog unless they would rather not be.
Scope
In scope:
- Web viewer — authentication bypass, session handling, XSS, CSRF, CSP bypass, or any unauthenticated path to the radio-control endpoints.
- Outbound HTTP — SSRF in feed fetching, webhooks, URL shortening, or weather and geocoding providers.
- Inbound webhook service — authentication and input handling.
- Credential handling — leakage of API keys, MQTT credentials, or bridge webhook URLs into logs, HTTP responses, or MQTT payloads.
- Command authorization — bypass of
[Admin_ACL], ban lists, or[Rate_Limits]. - Log injection — user-controlled input forging or corrupting log records.
Out of scope:
- The MeshCore protocol and firmware itself. Report those upstream to the MeshCore project.
- RF-layer attacks — jamming, flooding, or spoofing on an open, unlicensed mesh where messages are unauthenticated by design.
- Running the web viewer without a password on an untrusted network. The viewer's password is optional; when it is unset the interface is open to anyone who can reach the port. That is documented behavior, not a vulnerability — see docs/web-viewer.md.
- Denial of service achieved by exhausting shared mesh airtime.
Deployment guidance
The web viewer is designed for a trusted LAN. If you expose it more widely, set a password, terminate TLS at a reverse proxy, and restrict access at the network layer.
Configuration files hold API keys and broker credentials. The service installers
create a dedicated service account and set 0700/0750 modes on the
configuration, state, and log directories for that reason — preserve those
permissions if you install by hand.