mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-04 07:57:54 +00:00
Anso
c4e2595ded
* docs: remove security-sensitive implementation details from public documentation Generalize or remove internal architecture details that could aid targeted attacks — CVE tables, database schema, rate limit thresholds, proxy internals, encryption algorithm names, and WebSocket middleware bypass info. * test(metrics): fix flaky minute-bucket aggregation test Floor baseTime to the start of the current minute so baseTime + 5000 never crosses a minute boundary and produces 2 buckets instead of 1.
31 lines
1.5 KiB
Plaintext
31 lines
1.5 KiB
Plaintext
---
|
|
title: Security Advisories
|
|
description: Tracked CVEs, remediation status, and dependency security notes for Sencho's Docker image.
|
|
---
|
|
|
|
This page documents security-relevant changes across Sencho releases.
|
|
|
|
## April 2026 — Application Security Hardening
|
|
|
|
Version 0.25.2 includes application security hardening improvements:
|
|
|
|
- **Stricter file permissions** on sensitive files in the data directory, with automatic correction on startup
|
|
- **Stronger password requirements** aligned with [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html) recommendations
|
|
- **Reduced information disclosure** in application logs to prevent leaking sensitive details to logging aggregators
|
|
|
|
<Note>
|
|
Users on versions prior to 0.25.2 should upgrade promptly. These improvements are applied automatically — no manual action is required.
|
|
</Note>
|
|
|
|
---
|
|
|
|
## Dependency Security
|
|
|
|
Sencho's Docker image bundles Docker CLI and Docker Compose as statically linked Go binaries. Vulnerabilities in Go's standard library or their Go dependencies surface as CVEs against the Sencho image even though Sencho itself contains no Go source code.
|
|
|
|
Sencho tracks and remediates these CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle.
|
|
|
|
<Note>
|
|
If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/SaelixCode/sencho/releases) where each release documents dependency changes.
|
|
</Note>
|