---
title: Security Advisories
description: Tracked CVEs, remediation status, and dependency security notes for Sencho's Docker image.
---

This page documents security-relevant changes across Sencho releases. All fixes are applied automatically when you upgrade. No manual action is required unless stated otherwise.

## April 2026 (v0.25.0 - v0.25.2) — Application Security Hardening

A comprehensive security audit was performed before the Sencho paid tiers launch. Versions 0.25.0 through 0.25.2 include the following hardening:

### Input validation and path traversal

- **Path traversal prevention** in `env_file` resolution, preventing reads outside the compose directory
- **Stack name validation** enforced on all routes, rejecting names with special characters or path components
- **Tiered API rate limiting** with per-user session keying to protect against brute-force and abuse

### Authentication and secrets

- **Stronger password requirements** aligned with [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html) (minimum 8 characters, up from 6)
- **1-year default expiry** on node proxy JWT tokens (previously issued without expiry)
- **Stricter file permissions** (0600) on encryption key files, with automatic correction on startup
- **NIST-recommended initialization vectors** for encryption (backward compatible with existing data)
- **Pattern-based environment variable filtering** in the host console, blocking variables that contain sensitive keywords

### Information disclosure

- **Reduced log verbosity** to prevent leaking file paths, stack names, and admin usernames to logging aggregators
- **CORS denied by default** when `FRONTEND_URL` is unset in production (previously allowed all origins)
- **Webhook HMAC verification** now uses raw request bytes instead of re-serialized JSON

<Note>
  Users on versions prior to 0.25.0 should upgrade promptly. Existing passwords shorter than 8 characters remain valid until changed.
</Note>

---

## March 2026 (v0.19.x - v0.24.0) — Dependency CVE Remediation

### Docker CLI and Compose upgrades

Sencho's Docker image bundles Docker CLI and Docker Compose as statically linked Go binaries. Vulnerabilities in Go's standard library or their Go dependencies surface as CVEs against the Sencho image even though Sencho itself contains no Go source code.

The following dependency upgrades resolved all known CVEs at time of release:

- **Docker CLI** upgraded to v29.3.1 (static binaries, replacing Alpine package)
- **Docker Compose** upgraded from v2.40.3 to v5.1.1
- **Node.js dependencies** updated via Dependabot and Docker Scout audit

### API token hardening (v0.19.x)

- **Scope enforcement** tightened on API tokens, blocking access to sensitive endpoints (license management, user administration)
- **Token expiration** support added with configurable TTL

---

## Dependency Security

Sencho tracks and remediates dependency CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle.

<Note>
  If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/studio-saelix/sencho/releases) where each release documents dependency changes.
</Note>
