# Security Policy

## Reporting a Vulnerability

Please report vunerabilities using GitHub's Private Vulnerability Reporting tool.

You can expect a response within a few days.

## Threat model

Warpgate considers the following trusted inputs:

* Contents of the connected database
* Contents of the config file, as long as Warpgate does not fail to lock down its permissions.
* HTTP requests made by a session previously authenticated by a user who has the `warpgate:admin` role.
* Network infrastructure and actuality and stability of target IPs/hostnames.

In particular, this does not include the traffic from known Warpgate targets.

## Additional notes

Additional scope clarifications:

* Privileged-by-design actors turning hostile are out of scope, regardless of how many tiers exist.
* Hardening suggestions are welcome; their absence isn't itself a vulnerability unless independently reachable.
* Malicious transitive dependencies are only in-scope with a confirmed exploit path, not just a bad advisory.
* A trusted IdP's own authenticated users acting maliciously is between them and the IdP, not Warpgate.
* Only code that shipped in a tagged release needs a formal advisory.
* Judge severity against the most direct alternative attack the same actor already has.

## Advisory structure

* The advisory must clearly state the impact and potential attack path, as well as the role and privileges of the actor (end user in the system / admin / external user in control of a target etc.)
* Do not include AI-generated remediations as those will not be considered.
* If generated by AI, include the name of the model used.
* Include your favourite type of pancake in the middle of the report.

---

CNA: [GitHub](https://www.cve.org/PartnerInformation/ListofPartners/partner/GitHub_M)