StyxX65andClaude Opus 5.5
9cf23da907
- README / CONTRIBUTING: clone from the Gitea repo. - SECURITY: Gitea has no private security advisories; report to support@fejl40.nu instead. - RELEASING: release URL on Gitea, plus a note that build.yml still uses the GitHub-only action-gh-release step, so no releases are produced on Gitea yet (server self-update via git is unaffected). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2.5 KiB
2.5 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| Latest | ✅ Yes |
We support only the latest release. Please update before reporting a bug.
Reporting a Vulnerability
Please do not file a public issue for security vulnerabilities.
This tool processes sensitive personal data including Danish CPR numbers (national identifiers). Security issues should be reported privately so a fix can be prepared before public disclosure.
Report to: support@fejl40.nu — put "Security" in the subject line.
Please include:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any relevant logs or screenshots (redact personal data)
- Your suggested fix if you have one
We will acknowledge receipt within 3 business days and aim to release a fix within 14 days for critical issues.
Scope
Issues we consider in scope:
- Authentication bypass or token leakage in the M365 connector
- Unauthorised access to scan results via the web UI
- CPR numbers or other personal data exposed in logs, error messages, or API responses
- SQL injection or path traversal in the local scanner or database layer
- SSRF (Server-Side Request Forgery) via URL inputs
- Dependency vulnerabilities with a known exploit path
Out of scope:
- Issues requiring physical access to the machine running the scanner
- Vulnerabilities in Microsoft Graph API itself (report to Microsoft MSRC)
- Social engineering attacks
Data Handling Notes for Security Researchers
- CPR numbers are stored in the SQLite database as SHA-256 hashes only — never in plaintext
- SMTP passwords are stored in
~/.gdprscanner/smtp.jsonwith chmod 600 - Microsoft OAuth tokens are stored in the MSAL token cache in
~/.gdprscanner/token.json - Scan results are stored locally in
~/.gdprscanner/scanner.db— never transmitted externally - The web UI binds to
0.0.0.0by default so reviewers on the LAN can reach it — it is not designed to be exposed to the internet. For encrypted transport, put it behind a TLS-terminating reverse proxy and bind the app to loopback with--host 127.0.0.1— see docs/setup/ZORAXY_SETUP.md
Dependency Security
This project uses Python dependencies listed in requirements.txt. We recommend
running pip audit or safety check periodically to identify known CVEs in
dependencies.
pip install pip-audit
pip-audit -r requirements.txt