mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
SaelixCode
3da0aa6036
Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.
64 lines
3.2 KiB
Plaintext
64 lines
3.2 KiB
Plaintext
---
|
|
title: Security Advisories
|
|
description: Tracked CVEs, remediation status, and dependency security notes for Sencho's Docker image.
|
|
---
|
|
|
|
This page documents security-relevant changes across Sencho releases. All fixes are applied automatically when you upgrade. No manual action is required unless stated otherwise.
|
|
|
|
## April 2026 (v0.25.0 - v0.25.2) — Application Security Hardening
|
|
|
|
A comprehensive security audit was performed before the Sencho paid tiers launch. Versions 0.25.0 through 0.25.2 include the following hardening:
|
|
|
|
### Input validation and path traversal
|
|
|
|
- **Path traversal prevention** in `env_file` resolution, preventing reads outside the compose directory
|
|
- **Stack name validation** enforced on all routes, rejecting names with special characters or path components
|
|
- **Tiered API rate limiting** with per-user session keying to protect against brute-force and abuse
|
|
|
|
### Authentication and secrets
|
|
|
|
- **Stronger password requirements** aligned with [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html) (minimum 8 characters, up from 6)
|
|
- **1-year default expiry** on node proxy JWT tokens (previously issued without expiry)
|
|
- **Stricter file permissions** (0600) on encryption key files, with automatic correction on startup
|
|
- **NIST-recommended initialization vectors** for encryption (backward compatible with existing data)
|
|
- **Pattern-based environment variable filtering** in the host console, blocking variables that contain sensitive keywords
|
|
|
|
### Information disclosure
|
|
|
|
- **Reduced log verbosity** to prevent leaking file paths, stack names, and admin usernames to logging aggregators
|
|
- **CORS denied by default** when `FRONTEND_URL` is unset in production (previously allowed all origins)
|
|
- **Webhook HMAC verification** now uses raw request bytes instead of re-serialized JSON
|
|
|
|
<Note>
|
|
Users on versions prior to 0.25.0 should upgrade promptly. Existing passwords shorter than 8 characters remain valid until changed.
|
|
</Note>
|
|
|
|
---
|
|
|
|
## March 2026 (v0.19.x - v0.24.0) — Dependency CVE Remediation
|
|
|
|
### Docker CLI and Compose upgrades
|
|
|
|
Sencho's Docker image bundles Docker CLI and Docker Compose as statically linked Go binaries. Vulnerabilities in Go's standard library or their Go dependencies surface as CVEs against the Sencho image even though Sencho itself contains no Go source code.
|
|
|
|
The following dependency upgrades resolved all known CVEs at time of release:
|
|
|
|
- **Docker CLI** upgraded to v29.3.1 (static binaries, replacing Alpine package)
|
|
- **Docker Compose** upgraded from v2.40.3 to v5.1.1
|
|
- **Node.js dependencies** updated via Dependabot and Docker Scout audit
|
|
|
|
### API token hardening (v0.19.x)
|
|
|
|
- **Scope enforcement** tightened on API tokens, blocking access to sensitive endpoints (license management, user administration)
|
|
- **Token expiration** support added with configurable TTL
|
|
|
|
---
|
|
|
|
## Dependency Security
|
|
|
|
Sencho tracks and remediates dependency CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle.
|
|
|
|
<Note>
|
|
If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/studio-saelix/sencho/releases) where each release documents dependency changes.
|
|
</Note>
|