Skip to content

Security: IlhamHattaManggala/sentinel

Security

SECURITY.md

Security Policy - manggala/sentinel (sentinel)

Security is the core mission of manggala/sentinel. As a Web Application Firewall (WAF) and Intrusion Detection System for Laravel applications, we take security reports extremely seriously.

1. Supported Versions

We provide security updates and patches for the following supported versions of manggala/sentinel:

Package Version Supported Status Recommended Action
v1.x 🟢 Supported Current Active Release
< 1.0 🔴 End of Life Upgrade to v1.0.0+

2. Reporting a Vulnerability

If you discover a security vulnerability, flaw, or bypass mechanism within manggala/sentinel (or any scanner driver), please follow our responsible disclosure process:

2.1. Responsible Disclosure Process

  • Do NOT open a public GitHub issue for security vulnerabilities.
  • Send an email immediately to the project maintainer: Email: ilhamhattamanggala123@gmail.com
  • Include the following details in your report:
    1. Description of the vulnerability or bypass mechanism.
    2. Proof of Concept (PoC) code or steps to reproduce the issue.
    3. Affected component (e.g., SqlInjectionScanner, SentinelGuardMiddleware).
    4. Suggested fix or remediation if available.

2.2. Response Timeline

  • Acknowledgement: Within 24 hours of receiving your report.
  • Triage & Assessment: Within 48 hours to confirm the flaw and determine severity.
  • Patch & Release: An emergency hotfix patch (e.g., v1.0.1) will be issued within 72 hours of confirmation.

3. Threat Model & Security Scope

manggala/sentinel operates at the Laravel HTTP Kernel layer to inspect incoming requests.

In Scope for Vulnerability Reports:

  • WAF Bypass Patterns: Evasion techniques that bypass SqlInjectionScanner, XssScanner, PathTraversalScanner, or CommandInjectionScanner when configured with standard thresholds.
  • Middleware Elevation / Authentication Bypass: Methods that bypass SentinelGuardMiddleware or SentinelBruteForceMiddleware.
  • Dashboard Privilege Escalation: Unauthorized access to /sentinel or /api/sentinel/* endpoints.
  • SQLi or XSS in Sentinel Dashboard UI: Any vulnerability inside the Security Monitoring Dashboard itself.

Out of Scope:

  • Attacks requiring root / SSH access to the underlying web server hosting the application.
  • Social engineering or phishing attacks against application administrators.
  • Denials of service (DoS) originating from network-level SYN floods (which should be mitigated at the Cloudflare / AWS Shield infrastructure level).

4. Best Practices for Developers Deploying manggala/sentinel

  1. Keep Thresholds Tight: Ensure config('sentinel.threshold') is set to 5 or lower in production.
  2. Protect Dashboard Routes: Ensure /sentinel routes are guarded by strict authentication (auth and sentinel.admin middleware).
  3. Use Environment Variables for Secret Tokens: Never hardcode API keys or secret tokens in source code.
  4. Regularly Prune Logs: Configure automated log pruning via Artisan command: 
    php artisan sentinel:clear-logs --days=30

There aren't any published security advisories