VerseVDI-Data-Plane/SECURITY.md

Security policy

The Data Plane is not yet a supported production product. Phase 3C security work is performed in the private Gitea repository.

Reporting

Report suspected vulnerabilities through a confidential issue or direct private message to the repository owner. Do not include credentials, session grants, private host addresses, packet payloads, media, input, or unredacted captures in an ordinary issue.

Include:

• affected commit and artifact digest;
• exact reproduction conditions;
• expected and observed trust boundary;
• redacted logs or capture hashes; and
• whether the issue exposes a direct provider route, bypasses admission, weakens identity/protection, or causes unbounded resource use.

Do not publish a vulnerability or proof of concept until the owner has coordinated remediation and disclosure.

Non-negotiable security properties

• mTLS and session-scoped grants protect Server-to-gateway authority.
• One-time admission is bound to purpose, audience, device, session, sequence, gateway, and expiry.
• The client receives no provider endpoint or credential.
• Provider identity/protection failures do not fall back insecurely.
• External inputs are bounded before allocation.
• Authority loss releases input and stops new admission.
• Logs, metrics, traces, manifests, and support artifacts contain no secret, provider route, media, input, or high-cardinality session label.