SaelixCode
3da0aa6036
Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.
2.0 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| Latest release | Yes |
| Older releases | No |
Sencho is self-hosted software. Always run the latest release to receive security patches.
Reporting a Vulnerability
Please do not open a public issue for security vulnerabilities.
You can report security issues in two ways:
- Email: Send details to security@sencho.io
- GitHub: Use private vulnerability reporting in the Security tab
In your report, include: steps to reproduce, impact assessment, and any suggested fixes.
You can expect an initial response within 72 hours. We will work with you to understand and address the issue before any public disclosure.
Security Considerations
Sencho manages Docker containers and has access to the Docker socket. When deploying:
- Always run behind a reverse proxy with TLS in production
- Use strong passwords and rotate JWT secrets
- Restrict network access to the Sencho port
- Review the security configuration docs for hardening guidance
Verifying Release Artifacts
Every published image is signed and carries verifiable supply-chain artifacts. See the full guide at docs.sencho.io/operations/verifying-images.
Quick summary:
# Verify image signature (cosign keyless, Rekor logged)
cosign verify saelix/sencho:<tag> \
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# Scan with VEX applied (zero unresolved HIGH/CRITICAL CVEs)
trivy image --vex sencho.openvex.json --severity HIGH,CRITICAL saelix/sencho:<tag>
CycloneDX SBOM (sbom.cdx.json), SPDX SBOM (sbom.spdx.json), and the VEX document (sencho.openvex.json) are attached to every GitHub Release as downloadable assets and as cosign attestations on the image digest.