Anso
023801c980
cosign matches --certificate-identity-regexp case-sensitively against the certificate SAN. The signed identity is https://github.com/Studio-Saelix/sencho/.github/workflows/docker-publish.yml@refs/tags/vX.Y.Z, so the lower-case org spelling in the documented commands failed to match: verified against saelix/sencho:0.97.1 with cosign 3.1.3, the lower-case form errors with "no matching CertificateIdentity found" and the capitalised form verifies. Registry paths (ghcr.io/studio-saelix/...) stay lower-case because the registry lower-cases them; only the certificate identity is capitalised. Also restate what actually guards publication. The Docker Hub credentials live in the production environment, that environment allows only v* tag deployments, and required reviewers are intentionally unset because the Release PR merge is the only approval step. The dev workflow no longer describes that environment as an approval gate; the real distinction is that the dev build never publishes to Docker Hub.
2.0 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| Latest release | Yes |
| Older releases | No |
Sencho is self-hosted software. Always run the latest release to receive security patches.
Reporting a Vulnerability
Please do not open a public issue for security vulnerabilities.
You can report security issues in two ways:
- Email: Send details to security@sencho.io
- GitHub: Use private vulnerability reporting in the Security tab
In your report, include: steps to reproduce, impact assessment, and any suggested fixes.
You can expect an initial response within 72 hours. We will work with you to understand and address the issue before any public disclosure.
Security Considerations
Sencho manages Docker containers and has access to the Docker socket. When deploying:
- Always run behind a reverse proxy with TLS in production
- Use strong passwords and rotate JWT secrets
- Restrict network access to the Sencho port
- Review the security configuration docs for hardening guidance
Verifying Release Artifacts
Every published image is signed and carries verifiable supply-chain artifacts. See the full guide at docs.sencho.io/operations/verifying-images.
Quick summary:
# Verify image signature (cosign keyless, Rekor logged)
cosign verify saelix/sencho:<tag> \
--certificate-identity-regexp "https://github.com/Studio-Saelix/sencho/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# Scan with VEX applied (zero unresolved HIGH/CRITICAL CVEs)
trivy image --vex sencho.openvex.json --severity HIGH,CRITICAL saelix/sencho:<tag>
CycloneDX SBOM (sbom.cdx.json), SPDX SBOM (sbom.spdx.json), and the VEX document (sencho.openvex.json) are attached to every GitHub Release as downloadable assets and as cosign attestations on the image digest.