mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
SaelixCode
3da0aa6036
Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.
51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| Latest release | Yes |
|
|
| Older releases | No |
|
|
|
|
Sencho is self-hosted software. Always run the latest release to receive security patches.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not open a public issue for security vulnerabilities.**
|
|
|
|
You can report security issues in two ways:
|
|
|
|
1. **Email:** Send details to **security@sencho.io**
|
|
2. **GitHub:** Use [private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new) in the Security tab
|
|
|
|
In your report, include: steps to reproduce, impact assessment, and any suggested fixes.
|
|
|
|
You can expect an initial response within 72 hours. We will work with you to understand and address the issue before any public disclosure.
|
|
|
|
## Security Considerations
|
|
|
|
Sencho manages Docker containers and has access to the Docker socket. When deploying:
|
|
|
|
- Always run behind a reverse proxy with TLS in production
|
|
- Use strong passwords and rotate JWT secrets
|
|
- Restrict network access to the Sencho port
|
|
- Review the [security configuration docs](https://docs.sencho.io) for hardening guidance
|
|
|
|
## Verifying Release Artifacts
|
|
|
|
Every published image is signed and carries verifiable supply-chain artifacts. See the full guide at [docs.sencho.io/operations/verifying-images](https://docs.sencho.io/operations/verifying-images).
|
|
|
|
Quick summary:
|
|
|
|
```bash
|
|
# Verify image signature (cosign keyless, Rekor logged)
|
|
cosign verify saelix/sencho:<tag> \
|
|
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com
|
|
|
|
# Scan with VEX applied (zero unresolved HIGH/CRITICAL CVEs)
|
|
trivy image --vex sencho.openvex.json --severity HIGH,CRITICAL saelix/sencho:<tag>
|
|
```
|
|
|
|
CycloneDX SBOM (`sbom.cdx.json`), SPDX SBOM (`sbom.spdx.json`), and the VEX document (`sencho.openvex.json`) are attached to every GitHub Release as downloadable assets and as cosign attestations on the image digest.
|