StyxX65andClaude Opus 5.5
9cf23da907
- README / CONTRIBUTING: clone from the Gitea repo. - SECURITY: Gitea has no private security advisories; report to support@fejl40.nu instead. - RELEASING: release URL on Gitea, plus a note that build.yml still uses the GitHub-only action-gh-release step, so no releases are produced on Gitea yet (server self-update via git is unaffected). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
73 lines
2.5 KiB
Markdown
73 lines
2.5 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| Latest | ✅ Yes |
|
|
|
|
We support only the latest release. Please update before reporting a bug.
|
|
|
|
---
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not file a public issue for security vulnerabilities.**
|
|
|
|
This tool processes sensitive personal data including Danish CPR numbers (national
|
|
identifiers). Security issues should be reported privately so a fix can be prepared
|
|
before public disclosure.
|
|
|
|
**Report to:** [support@fejl40.nu](mailto:support@fejl40.nu) — put "Security" in the subject line.
|
|
|
|
Please include:
|
|
- A description of the vulnerability and its potential impact
|
|
- Steps to reproduce the issue
|
|
- Any relevant logs or screenshots (redact personal data)
|
|
- Your suggested fix if you have one
|
|
|
|
We will acknowledge receipt within **3 business days** and aim to release a fix
|
|
within **14 days** for critical issues.
|
|
|
|
---
|
|
|
|
## Scope
|
|
|
|
Issues we consider in scope:
|
|
|
|
- Authentication bypass or token leakage in the M365 connector
|
|
- Unauthorised access to scan results via the web UI
|
|
- CPR numbers or other personal data exposed in logs, error messages, or API responses
|
|
- SQL injection or path traversal in the local scanner or database layer
|
|
- SSRF (Server-Side Request Forgery) via URL inputs
|
|
- Dependency vulnerabilities with a known exploit path
|
|
|
|
Out of scope:
|
|
|
|
- Issues requiring physical access to the machine running the scanner
|
|
- Vulnerabilities in Microsoft Graph API itself (report to Microsoft MSRC)
|
|
- Social engineering attacks
|
|
|
|
---
|
|
|
|
## Data Handling Notes for Security Researchers
|
|
|
|
- CPR numbers are stored in the SQLite database as **SHA-256 hashes only** — never in plaintext
|
|
- SMTP passwords are stored in `~/.gdprscanner/smtp.json` with chmod 600
|
|
- Microsoft OAuth tokens are stored in the MSAL token cache in `~/.gdprscanner/token.json`
|
|
- Scan results are stored locally in `~/.gdprscanner/scanner.db` — never transmitted externally
|
|
- The web UI binds to `0.0.0.0` by default so reviewers on the LAN can reach it — it is not designed to be exposed to the internet. For encrypted transport, put it behind a TLS-terminating reverse proxy and bind the app to loopback with `--host 127.0.0.1` — see [docs/setup/ZORAXY_SETUP.md](docs/setup/ZORAXY_SETUP.md)
|
|
|
|
---
|
|
|
|
## Dependency Security
|
|
|
|
This project uses Python dependencies listed in `requirements.txt`. We recommend
|
|
running `pip audit` or `safety check` periodically to identify known CVEs in
|
|
dependencies.
|
|
|
|
```bash
|
|
pip install pip-audit
|
|
pip-audit -r requirements.txt
|
|
```
|