36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# Security policy
|
|
|
|
The Data Plane is not yet a supported production product. Phase 3C security
|
|
work is performed in the private Gitea repository.
|
|
|
|
## Reporting
|
|
|
|
Report suspected vulnerabilities through a confidential issue or direct
|
|
private message to the repository owner. Do not include credentials, session
|
|
grants, private host addresses, packet payloads, media, input, or unredacted
|
|
captures in an ordinary issue.
|
|
|
|
Include:
|
|
|
|
- affected commit and artifact digest;
|
|
- exact reproduction conditions;
|
|
- expected and observed trust boundary;
|
|
- redacted logs or capture hashes; and
|
|
- whether the issue exposes a direct provider route, bypasses admission,
|
|
weakens identity/protection, or causes unbounded resource use.
|
|
|
|
Do not publish a vulnerability or proof of concept until the owner has
|
|
coordinated remediation and disclosure.
|
|
|
|
## Non-negotiable security properties
|
|
|
|
- mTLS and session-scoped grants protect Server-to-gateway authority.
|
|
- One-time admission is bound to purpose, audience, device, session, sequence,
|
|
gateway, and expiry.
|
|
- The client receives no provider endpoint or credential.
|
|
- Provider identity/protection failures do not fall back insecurely.
|
|
- External inputs are bounded before allocation.
|
|
- Authority loss releases input and stops new admission.
|
|
- Logs, metrics, traces, manifests, and support artifacts contain no secret,
|
|
provider route, media, input, or high-cardinality session label.
|