Skip to content

SECURITY.md

Latest commit

 

History

History
24 lines (18 loc) · 999 Bytes

SECURITY.md

File metadata and controls

24 lines (18 loc) · 999 Bytes
Raw

Security policy

Cloudfall manages servers over SSH and renders infrastructure configuration, so security reports are taken seriously.

Reporting a vulnerability

Use GitHub's private vulnerability reporting on this repository ("Report a vulnerability" under the Security tab). Do not open a public issue for security-sensitive findings.

Please include the affected component (config/, sdk/, engine/), a reproduction, and the impact you believe it has.

Scope notes

  • State directories must never contain secret values; schemas and validation are designed to reject them. A way to smuggle credentials into rendered inventory or observations is a vulnerability
  • The inspection pipeline is read-only by design. Any code path through which cloudfall_inspect or the audit toolchain modifies a target host is a vulnerability
  • Rendered configuration that weakens documented trust boundaries (proxy header trust, mTLS requirements, loopback-only listeners) is a vulnerability