Skip to content

SECURITY.md

Latest commit

 

History

History
63 lines (47 loc) · 2.49 KB

SECURITY.md

File metadata and controls

63 lines (47 loc) · 2.49 KB
Raw

Security Policy

Helmio manages supervisord instances across remote servers and therefore handles sensitive material: SSH access, encrypted connection credentials, agent tokens and audit data. We take security reports seriously.

Supported versions

Helmio is pre-1.0 software. Security fixes are applied to the latest released version on the main branch only.

Version Supported
0.x (latest) ✅
older 0.x ❌

Reporting a vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report privately through one of the following channels:

  1. GitHub Security Advisories (preferred) — open a draft advisory at https://github.com/fahrettinaksoy/helMiO/security/advisories/new.
  2. Email — send details to the maintainer listed on the GitHub profile @fahrettinaksoy.

Please include:

  • A description of the vulnerability and its impact.
  • Steps to reproduce (proof-of-concept, affected endpoints/components).
  • Affected version(s) / commit hash.
  • Any suggested remediation, if known.

What to expect

  • Acknowledgement within 72 hours.
  • An initial assessment and severity classification within 7 days.
  • We will keep you informed about progress toward a fix and coordinate a disclosure timeline with you. We aim to ship a fix within 30 days for high-severity issues.
  • With your permission, we will credit you in the release notes.

Scope & hardening notes

Helmio is a local-first desktop app: all data lives on your machine and the app only connects outwards to the supervisord instances you configure. Securing those targets — and the machine Helmio runs on — is your responsibility. At minimum:

  • Protect the secret key. Connection secrets are encrypted at rest with AES-256-GCM; the key lives in the app config directory (.secret-key, mode 0600) or in HELMIO_SECRET_KEY. Anyone who reads it can decrypt your stored credentials.
  • Restrict network access to target supervisord instances (TCP XML-RPC, Unix socket over SSH) to trusted hosts.
  • Password-protect [inet_http_server] and prefer binding it to 127.0.0.1 with SSH tunnelling over exposing it to the network.
  • Rotate Helmio Agent tokens regularly and keep the agent bound to loopback or a trusted network only.
  • Keep dependencies up to date (Dependabot is enabled in this repo).

Thank you for helping keep Helmio and its users safe.